From bba0d233316764685ed7d311d96b52dfd3a1459d Mon Sep 17 00:00:00 2001
From: Hacl Bot <hacl-star@mailo.com>
Date: Fri, 30 Aug 2024 08:18:15 +0000
Subject: [PATCH] [CI] update code

---
 include/Hacl_Bignum32.h                       | 382 ++++++++++-------
 include/Hacl_Hash_Blake2b.h                   |  43 +-
 include/Hacl_Hash_Blake2b_Simd256.h           |  98 +++--
 include/Hacl_Hash_Blake2s.h                   | 102 +++--
 include/Hacl_Hash_Blake2s_Simd128.h           |  98 +++--
 include/Hacl_Hash_SHA3.h                      |   6 +-
 include/Hacl_Hash_SHA3_Simd256.h              |  12 +-
 include/internal/Hacl_Bignum_K256.h           |   6 +-
 include/internal/Hacl_Hash_Blake2b.h          |  16 +-
 include/internal/Hacl_Hash_Blake2b_Simd256.h  |   1 +
 include/internal/Hacl_Hash_Blake2s.h          |   1 +
 include/internal/Hacl_Hash_Blake2s_Simd128.h  |   1 +
 include/msvc/Hacl_Bignum32.h                  | 382 ++++++++++-------
 include/msvc/Hacl_Hash_Blake2b.h              |  43 +-
 include/msvc/Hacl_Hash_Blake2b_Simd256.h      |  98 +++--
 include/msvc/Hacl_Hash_Blake2s.h              | 102 +++--
 include/msvc/Hacl_Hash_Blake2s_Simd128.h      |  98 +++--
 include/msvc/Hacl_Hash_SHA3.h                 |   6 +-
 include/msvc/Hacl_Hash_SHA3_Simd256.h         |  12 +-
 include/msvc/internal/Hacl_Hash_Blake2b.h     |  16 +-
 .../msvc/internal/Hacl_Hash_Blake2b_Simd256.h |   1 +
 include/msvc/internal/Hacl_Hash_Blake2s.h     |   1 +
 .../msvc/internal/Hacl_Hash_Blake2s_Simd128.h |   1 +
 karamel/include/krml/internal/target.h        |  20 +
 ocaml/ctypes.depend                           |  10 +-
 .../lib/Hacl_Hash_Blake2b_Simd256_bindings.ml |   4 +-
 ocaml/lib/Hacl_Hash_Blake2b_bindings.ml       |  30 +-
 .../lib/Hacl_Hash_Blake2s_Simd128_bindings.ml |   4 +-
 ocaml/lib/Hacl_Hash_Blake2s_bindings.ml       |  22 +-
 src/EverCrypt_HMAC.c                          |  14 +-
 src/EverCrypt_Hash.c                          |   6 +-
 src/Hacl_Bignum.c                             |  16 +-
 src/Hacl_Bignum256.c                          |  14 +-
 src/Hacl_Bignum256_32.c                       |  14 +-
 src/Hacl_Bignum32.c                           | 390 +++++++++++-------
 src/Hacl_Bignum4096.c                         |  14 +-
 src/Hacl_Bignum4096_32.c                      |  14 +-
 src/Hacl_Bignum64.c                           |   8 +-
 src/Hacl_Ed25519.c                            |  32 +-
 src/Hacl_FFDHE.c                              |   4 +-
 src/Hacl_HMAC.c                               |  14 +-
 src/Hacl_HMAC_Blake2b_256.c                   |   3 +
 src/Hacl_HMAC_Blake2s_128.c                   |   4 +-
 src/Hacl_Hash_Blake2b.c                       | 178 +++++---
 src/Hacl_Hash_Blake2b_Simd256.c               | 247 +++++++----
 src/Hacl_Hash_Blake2s.c                       | 259 ++++++++----
 src/Hacl_Hash_Blake2s_Simd128.c               | 248 +++++++----
 src/Hacl_Hash_SHA3.c                          |   6 +-
 src/Hacl_Hash_SHA3_Simd256.c                  |  12 +-
 src/Hacl_K256_ECDSA.c                         |  14 +-
 src/Hacl_RSAPSS.c                             |  25 +-
 src/msvc/EverCrypt_HMAC.c                     |  14 +-
 src/msvc/EverCrypt_Hash.c                     |   6 +-
 src/msvc/Hacl_Bignum32.c                      | 382 ++++++++++-------
 src/msvc/Hacl_HMAC.c                          |  14 +-
 src/msvc/Hacl_HMAC_Blake2b_256.c              |   3 +
 src/msvc/Hacl_HMAC_Blake2s_128.c              |   4 +-
 src/msvc/Hacl_Hash_Blake2b.c                  | 178 +++++---
 src/msvc/Hacl_Hash_Blake2b_Simd256.c          | 247 +++++++----
 src/msvc/Hacl_Hash_Blake2s.c                  | 259 ++++++++----
 src/msvc/Hacl_Hash_Blake2s_Simd128.c          | 248 +++++++----
 src/msvc/Hacl_Hash_SHA3.c                     |   6 +-
 src/msvc/Hacl_Hash_SHA3_Simd256.c             |  12 +-
 src/wasm/EverCrypt_Hash.wasm                  | Bin 58084 -> 58090 bytes
 src/wasm/Hacl_Bignum.wasm                     | Bin 74661 -> 74661 bytes
 src/wasm/Hacl_Bignum32.wasm                   | Bin 13286 -> 13286 bytes
 src/wasm/Hacl_Bignum_Base.wasm                | Bin 24692 -> 24692 bytes
 src/wasm/Hacl_GenericField64.wasm             | Bin 11718 -> 11718 bytes
 src/wasm/Hacl_HKDF_Blake2s_128.wasm           | Bin 1392 -> 1392 bytes
 src/wasm/Hacl_HMAC.wasm                       | Bin 28160 -> 28174 bytes
 src/wasm/Hacl_Hash_Blake2b.wasm               | Bin 22942 -> 23807 bytes
 src/wasm/Hacl_Hash_Blake2b_Simd256.wasm       | Bin 11362 -> 11946 bytes
 src/wasm/Hacl_Hash_Blake2s.wasm               | Bin 21136 -> 21925 bytes
 src/wasm/Hacl_Hash_Blake2s_Simd128.wasm       | Bin 10194 -> 10776 bytes
 src/wasm/INFO.txt                             |   4 +-
 src/wasm/layouts.json                         |   2 +-
 76 files changed, 2986 insertions(+), 1545 deletions(-)

diff --git a/include/Hacl_Bignum32.h b/include/Hacl_Bignum32.h
index 84a839a9..709f22d9 100644
--- a/include/Hacl_Bignum32.h
+++ b/include/Hacl_Bignum32.h
@@ -56,9 +56,18 @@ of `len` unsigned 32-bit integers, i.e. uint32_t[len].
 /**
 Write `a + b mod 2 ^ (32 * len)` in `res`.
 
-  This functions returns the carry.
-
-  The arguments a, b and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len]
+  This function returns the carry.
+  
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `b` or `res`. May have exactly equal memory
+    location to `b` or `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `a` or `res`. May have exactly
+    equal memory location to `a` or `res`.
+  @param[out] res Points to `len` number of limbs where the carry is written, i.e. `uint32_t[len]`.
+    Must not partially overlap the memory locations of `a` or `b`. May have
+    exactly equal memory location to `a` or `b`.
 */
 uint32_t Hacl_Bignum32_add(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res);
 
@@ -67,82 +76,134 @@ Write `a - b mod 2 ^ (32 * len)` in `res`.
 
   This functions returns the carry.
 
-  The arguments a, b and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len]
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `b` or `res`. May have exactly
+    equal memory location to `b` or `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `a` or `res`. May have exactly
+    equal memory location to `a` or `res`.
+  @param[out] res Points to `len` number of limbs where the carry is written, i.e. `uint32_t[len]`.
+    Must not partially overlap the memory locations of `a` or `b`. May have
+    exactly equal memory location to `a` or `b`.
 */
 uint32_t Hacl_Bignum32_sub(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res);
 
 /**
 Write `(a + b) mod n` in `res`.
 
-  The arguments a, b, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • a < n
-  • b < n
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `b` or `res`. May have exactly
+    equal memory location to `b` or `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `a` or `res`. May have exactly
+    equal memory location to `a` or `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a`, `b`, and `res`.
+  @param[out] res Points to `len` number of limbs where the result is written, i.e. `uint32_t[len]`.
+    Must not partially overlap the memory locations of `a` or `b`. May have
+    exactly equal memory location to `a` or `b`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `a < n`
+    - `b < n`
 */
 void Hacl_Bignum32_add_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *b, uint32_t *res);
 
 /**
 Write `(a - b) mod n` in `res`.
 
-  The arguments a, b, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • a < n
-  • b < n
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `b` or `res`. May have exactly
+    equal memory location to `b` or `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `a` or `res`. May have exactly
+    equal memory location to `a` or `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a`, `b`, and `res`.
+  @param[out] res Points to `len` number of limbs where the result is written, i.e. `uint32_t[len]`.
+    Must not partially overlap the memory locations of `a` or `b`. May have
+    exactly equal memory location to `a` or `b`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `a < n`
+    - `b < n`
 */
 void Hacl_Bignum32_sub_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *b, uint32_t *res);
 
 /**
 Write `a * b` in `res`.
 
-  The arguments a and b are meant to be `len` limbs in size, i.e. uint32_t[len].
-  The outparam res is meant to be `2*len` limbs in size, i.e. uint32_t[2*len].
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `b` and `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `a` and `res`.
+  @param[out] res Points to `2*len` number of limbs where the result is written, i.e. `uint32_t[2*len]`.
+    Must be disjoint from the memory locations of `a` and `b`.
 */
 void Hacl_Bignum32_mul(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res);
 
 /**
 Write `a * a` in `res`.
 
-  The argument a is meant to be `len` limbs in size, i.e. uint32_t[len].
-  The outparam res is meant to be `2*len` limbs in size, i.e. uint32_t[2*len].
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[out] res Points to `2*len` number of limbs where the result is written, i.e. `uint32_t[2*len]`.
+    Must be disjoint from the memory location of `a`.
 */
 void Hacl_Bignum32_sqr(uint32_t len, uint32_t *a, uint32_t *res);
 
 /**
 Write `a mod n` in `res`.
 
-  The argument a is meant to be `2*len` limbs in size, i.e. uint32_t[2*len].
-  The argument n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  The function returns false if any of the following preconditions are violated,
-  true otherwise.
-   • 1 < n
-   • n % 2 = 1 
+  @param[in] a Points to `2*len` number of limbs, i.e. `uint32_t[2*len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `n`.
+  
+  @return `false` if any precondition is violated, `true` otherwise.
+  
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `1 < n`
+    - `n % 2 = 1`
 */
 bool Hacl_Bignum32_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *res);
 
 /**
 Write `a ^ b mod n` in `res`.
 
-  The arguments a, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  The argument b is a bignum of any size, and bBits is an upper bound on the
-  number of significant bits of b. A tighter bound results in faster execution
-  time. When in doubt, the number of bits for the bignum size is always a safe
-  default, e.g. if b is a 4096-bit bignum, bBits should be 4096.
-
-  The function is *NOT* constant-time on the argument b. See the
-  mod_exp_consttime_* functions for constant-time variants.
-
-  The function returns false if any of the following preconditions are violated,
-  true otherwise.
-   • n % 2 = 1
-   • 1 < n
-   • b < pow2 bBits
-   • a < n
+  This function is *NOT* constant-time on the argument `b`. See the
+  `mod_exp_consttime_*` functions for constant-time variants.
+
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `n` and `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `res`.
+  @param[in] b Points to a bignum of any size, with an upper bound of `bBits` number of
+    significant bits. Must be disjoint from the memory location of `res`.
+  @param[in] bBits An upper bound on the number of significant bits of `b`.
+    A tighter bound results in faster execution time. When in doubt, the number
+    of bits for the bignum size is always a safe default, e.g. if `b` is a 4096-bit
+    bignum, `bBits` should be `4096`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a`, `b`, and `n`.
+    
+  @return `false` if any preconditions are violated, `true` otherwise.
+  
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n % 2 = 1`
+    - `1 < n`
+    - `b < pow2 bBits`
+    - `a < n`
 */
 bool
 Hacl_Bignum32_mod_exp_vartime(
@@ -157,22 +218,30 @@ Hacl_Bignum32_mod_exp_vartime(
 /**
 Write `a ^ b mod n` in `res`.
 
-  The arguments a, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  The argument b is a bignum of any size, and bBits is an upper bound on the
-  number of significant bits of b. A tighter bound results in faster execution
-  time. When in doubt, the number of bits for the bignum size is always a safe
-  default, e.g. if b is a 4096-bit bignum, bBits should be 4096.
-
-  This function is constant-time over its argument b, at the cost of a slower
-  execution time than mod_exp_vartime.
-
-  The function returns false if any of the following preconditions are violated,
-  true otherwise.
-   • n % 2 = 1
-   • 1 < n
-   • b < pow2 bBits
-   • a < n
+  This function is constant-time over its argument `b`, at the cost of a slower
+  execution time than `mod_exp_vartime_*`.
+  
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `n` and `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `res`.
+  @param[in] b Points to a bignum of any size, with an upper bound of `bBits` number of
+    significant bits. Must be disjoint from the memory location of `res`.
+  @param[in] bBits An upper bound on the number of significant bits of `b`.
+    A tighter bound results in faster execution time. When in doubt, the number
+    of bits for the bignum size is always a safe default, e.g. if `b` is a 4096-bit
+    bignum, `bBits` should be `4096`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a`, `b`, and `n`.
+    
+  @return `false` if any preconditions are violated, `true` otherwise.
+
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n % 2 = 1`
+    - `1 < n`
+    - `b < pow2 bBits`
+    - `a < n`
 */
 bool
 Hacl_Bignum32_mod_exp_consttime(
@@ -187,18 +256,23 @@ Hacl_Bignum32_mod_exp_consttime(
 /**
 Write `a ^ (-1) mod n` in `res`.
 
-  The arguments a, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • n is a prime
-
-  The function returns false if any of the following preconditions are violated,
-  true otherwise.
-  • n % 2 = 1
-  • 1 < n
-  • 0 < a
-  • a < n
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `n` and `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `res`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `a` and `n`.
+    
+  @return `false` if any preconditions (except the precondition: `n` is a prime)
+    are violated, `true` otherwise.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n` is a prime
+    - `n % 2 = 1`
+    - `1 < n`
+    - `0 < a`
+    - `a < n`
 */
 bool
 Hacl_Bignum32_mod_inv_prime_vartime(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *res);
@@ -212,15 +286,16 @@ Hacl_Bignum32_mod_inv_prime_vartime(uint32_t len, uint32_t *n, uint32_t *a, uint
 /**
 Heap-allocate and initialize a montgomery context.
 
-  The argument n is meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • n % 2 = 1
-  • 1 < n
+  @param n Points to `len` number of limbs, i.e. `uint32_t[len]`.
 
-  The caller will need to call Hacl_Bignum32_mont_ctx_free on the return value
-  to avoid memory leaks.
+  @return A pointer to an allocated and initialized Montgomery context is returned.
+    Clients will need to call `Hacl_Bignum32_mont_ctx_free` on the return value to
+    avoid memory leaks.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n % 2 = 1`
+    - `1 < n`
 */
 Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32
 *Hacl_Bignum32_mont_ctx_init(uint32_t len, uint32_t *n);
@@ -228,16 +303,18 @@ Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32
 /**
 Deallocate the memory previously allocated by Hacl_Bignum32_mont_ctx_init.
 
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
+  @param k Points to a Montgomery context obtained through `Hacl_Bignum32_mont_ctx_init`.
 */
 void Hacl_Bignum32_mont_ctx_free(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k);
 
 /**
 Write `a mod n` in `res`.
 
-  The argument a is meant to be `2*len` limbs in size, i.e. uint32_t[2*len].
-  The outparam res is meant to be `len` limbs in size, i.e. uint32_t[len].
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
+  @param[in] k Points to a Montgomery context obtained from `Hacl_Bignum32_mont_ctx_init`.
+  @param[in] a Points to `2*len` number of limbs, i.e. `uint32_t[2*len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `a`.
 */
 void
 Hacl_Bignum32_mod_precomp(
@@ -249,21 +326,25 @@ Hacl_Bignum32_mod_precomp(
 /**
 Write `a ^ b mod n` in `res`.
 
-  The arguments a and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
-
-  The argument b is a bignum of any size, and bBits is an upper bound on the
-  number of significant bits of b. A tighter bound results in faster execution
-  time. When in doubt, the number of bits for the bignum size is always a safe
-  default, e.g. if b is a 4096-bit bignum, bBits should be 4096.
-
-  The function is *NOT* constant-time on the argument b. See the
-  mod_exp_consttime_* functions for constant-time variants.
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • b < pow2 bBits
-  • a < n
+  This function is *NOT* constant-time on the argument `b`. See the
+  `mod_exp_consttime_*` functions for constant-time variants.
+
+  @param[in] k Points to a Montgomery context obtained from `Hacl_Bignum32_mont_ctx_init`.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[in] b Points to a bignum of any size, with an upper bound of `bBits` number of
+    significant bits. Must be disjoint from the memory location of `res`.
+  @param[in] bBits An upper bound on the number of significant bits of `b`.
+    A tighter bound results in faster execution time. When in doubt, the number
+    of bits for the bignum size is always a safe default, e.g. if `b` is a 4096-bit
+    bignum, `bBits` should be `4096`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `b`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `b < pow2 bBits`
+    - `a < n`
 */
 void
 Hacl_Bignum32_mod_exp_vartime_precomp(
@@ -277,21 +358,25 @@ Hacl_Bignum32_mod_exp_vartime_precomp(
 /**
 Write `a ^ b mod n` in `res`.
 
-  The arguments a and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
-
-  The argument b is a bignum of any size, and bBits is an upper bound on the
-  number of significant bits of b. A tighter bound results in faster execution
-  time. When in doubt, the number of bits for the bignum size is always a safe
-  default, e.g. if b is a 4096-bit bignum, bBits should be 4096.
-
   This function is constant-time over its argument b, at the cost of a slower
-  execution time than mod_exp_vartime_*.
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • b < pow2 bBits
-  • a < n
+  execution time than `mod_exp_vartime_*`.
+
+  @param[in] k Points to a Montgomery context obtained from `Hacl_Bignum32_mont_ctx_init`.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[in] b Points to a bignum of any size, with an upper bound of `bBits` number of
+    significant bits. Must be disjoint from the memory location of `res`.
+  @param[in] bBits An upper bound on the number of significant bits of `b`.
+    A tighter bound results in faster execution time. When in doubt, the number
+    of bits for the bignum size is always a safe default, e.g. if `b` is a 4096-bit
+    bignum, `bBits` should be `4096`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `b`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `b < pow2 bBits`
+    - `a < n`
 */
 void
 Hacl_Bignum32_mod_exp_consttime_precomp(
@@ -305,14 +390,17 @@ Hacl_Bignum32_mod_exp_consttime_precomp(
 /**
 Write `a ^ (-1) mod n` in `res`.
 
-  The argument a and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • n is a prime
-  • 0 < a
-  • a < n
+  @param[in] k Points to a Montgomery context obtained through `Hacl_Bignum32_mont_ctx_init`.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `a`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n` is a prime
+    - `0 < a`
+    - `a < n`
 */
 void
 Hacl_Bignum32_mod_inv_prime_vartime_precomp(
@@ -330,42 +418,48 @@ Hacl_Bignum32_mod_inv_prime_vartime_precomp(
 /**
 Load a bid-endian bignum from memory.
 
-  The argument b points to `len` bytes of valid memory.
-  The function returns a heap-allocated bignum of size sufficient to hold the
-   result of loading b, or NULL if either the allocation failed, or the amount of
-    required memory would exceed 4GB.
-
-  If the return value is non-null, clients must eventually call free(3) on it to
-  avoid memory leaks.
+  @param len Size of `b` as number of bytes.
+  @param b Points to `len` number of bytes, i.e. `uint8_t[len]`.
+  
+  @return A heap-allocated bignum of size sufficient to hold the result of
+    loading `b`. Otherwise, `NULL`, if either the allocation failed, or the amount
+    of required memory would exceed 4GB. Clients must `free(3)` any non-null return
+    value to avoid memory leaks.
 */
 uint32_t *Hacl_Bignum32_new_bn_from_bytes_be(uint32_t len, uint8_t *b);
 
 /**
 Load a little-endian bignum from memory.
 
-  The argument b points to `len` bytes of valid memory.
-  The function returns a heap-allocated bignum of size sufficient to hold the
-   result of loading b, or NULL if either the allocation failed, or the amount of
-    required memory would exceed 4GB.
-
-  If the return value is non-null, clients must eventually call free(3) on it to
-  avoid memory leaks.
+  @param len Size of `b` as number of bytes.
+  @param b Points to `len` number of bytes, i.e. `uint8_t[len]`.
+  
+  @return A heap-allocated bignum of size sufficient to hold the result of
+    loading `b`. Otherwise, `NULL`, if either the allocation failed, or the amount
+    of required memory would exceed 4GB. Clients must `free(3)` any non-null return
+    value to avoid memory leaks.
 */
 uint32_t *Hacl_Bignum32_new_bn_from_bytes_le(uint32_t len, uint8_t *b);
 
 /**
 Serialize a bignum into big-endian memory.
 
-  The argument b points to a bignum of ⌈len / 4⌉ size.
-  The outparam res points to `len` bytes of valid memory.
+  @param[in] len Size of `b` as number of bytes.
+  @param[in] b Points to a bignum of `ceil(len/4)` size. Must be disjoint from
+    the memory location of `res`.
+  @param[out] res Points to `len` number of bytes, i.e. `uint8_t[len]`. Must be
+    disjoint from the memory location of `b`.
 */
 void Hacl_Bignum32_bn_to_bytes_be(uint32_t len, uint32_t *b, uint8_t *res);
 
 /**
 Serialize a bignum into little-endian memory.
 
-  The argument b points to a bignum of ⌈len / 4⌉ size.
-  The outparam res points to `len` bytes of valid memory.
+  @param[in] len Size of `b` as number of bytes.
+  @param[in] b Points to a bignum of `ceil(len/4)` size. Must be disjoint from
+    the memory location of `res`.
+  @param[out] res Points to `len` number of bytes, i.e. `uint8_t[len]`. Must be
+    disjoint from the memory location of `b`.
 */
 void Hacl_Bignum32_bn_to_bytes_le(uint32_t len, uint32_t *b, uint8_t *res);
 
@@ -378,14 +472,22 @@ void Hacl_Bignum32_bn_to_bytes_le(uint32_t len, uint32_t *b, uint8_t *res);
 /**
 Returns 2^32 - 1 if a < b, otherwise returns 0.
 
- The arguments a and b are meant to be `len` limbs in size, i.e. uint32_t[len].
+  @param len Number of limbs.
+  @param a Points to `len` number of limbs, i.e. `uint32_t[len]`.
+  @param b Points to `len` number of limbs, i.e. `uint32_t[len]`.
+  
+  @return `2^32 - 1` if `a < b`, otherwise, `0`.
 */
 uint32_t Hacl_Bignum32_lt_mask(uint32_t len, uint32_t *a, uint32_t *b);
 
 /**
 Returns 2^32 - 1 if a = b, otherwise returns 0.
 
- The arguments a and b are meant to be `len` limbs in size, i.e. uint32_t[len].
+  @param len Number of limbs.
+  @param a Points to `len` number of limbs, i.e. `uint32_t[len]`.
+  @param b Points to `len` number of limbs, i.e. `uint32_t[len]`.
+  
+  @return `2^32 - 1` if a = b, otherwise, `0`.
 */
 uint32_t Hacl_Bignum32_eq_mask(uint32_t len, uint32_t *a, uint32_t *b);
 
diff --git a/include/Hacl_Hash_Blake2b.h b/include/Hacl_Hash_Blake2b.h
index 3403fc83..fcc2d5df 100644
--- a/include/Hacl_Hash_Blake2b.h
+++ b/include/Hacl_Hash_Blake2b.h
@@ -53,6 +53,24 @@ typedef struct Hacl_Hash_Blake2b_blake2_params_s
 }
 Hacl_Hash_Blake2b_blake2_params;
 
+typedef struct Hacl_Hash_Blake2b_index_s
+{
+  uint8_t key_length;
+  uint8_t digest_length;
+  bool last_node;
+}
+Hacl_Hash_Blake2b_index;
+
+#define HACL_HASH_BLAKE2B_BLOCK_BYTES (128U)
+
+#define HACL_HASH_BLAKE2B_OUT_BYTES (64U)
+
+#define HACL_HASH_BLAKE2B_KEY_BYTES (64U)
+
+#define HACL_HASH_BLAKE2B_SALT_BYTES (16U)
+
+#define HACL_HASH_BLAKE2B_PERSONAL_BYTES (16U)
+
 typedef struct K____uint64_t___uint64_t__s
 {
   uint64_t *fst;
@@ -64,7 +82,8 @@ typedef struct Hacl_Hash_Blake2b_block_state_t_s
 {
   uint8_t fst;
   uint8_t snd;
-  K____uint64_t___uint64_t_ thd;
+  bool thd;
+  K____uint64_t___uint64_t_ f3;
 }
 Hacl_Hash_Blake2b_block_state_t;
 
@@ -92,7 +111,11 @@ The caller must satisfy the following requirements.
 
 */
 Hacl_Hash_Blake2b_state_t
-*Hacl_Hash_Blake2b_malloc_with_params_and_key(Hacl_Hash_Blake2b_blake2_params *p, uint8_t *k);
+*Hacl_Hash_Blake2b_malloc_with_params_and_key(
+  Hacl_Hash_Blake2b_blake2_params *p,
+  bool last_node,
+  uint8_t *k
+);
 
 /**
  Specialized allocation function that picks default values for all
@@ -116,7 +139,7 @@ Hacl_Hash_Blake2b_state_t *Hacl_Hash_Blake2b_malloc(void);
 
 /**
  General-purpose re-initialization function with parameters and
-key. You cannot change digest_length or key_length, meaning those values in
+key. You cannot change digest_length, key_length, or last_node, meaning those values in
 the parameters object must be the same as originally decided via one of the
 malloc functions. All other values of the parameter can be changed. The behavior
 is unspecified if you violate this precondition.
@@ -159,10 +182,14 @@ at least `digest_length` bytes, where `digest_length` was determined by your
 choice of `malloc` function. Concretely, if you used `malloc` or
 `malloc_with_key`, then the expected length is 32 for S, or 64 for B (default
 digest length). If you used `malloc_with_params_and_key`, then the expected
-length is whatever you chose for the `digest_length` field of your
-parameters.
+length is whatever you chose for the `digest_length` field of your parameters.
+For convenience, this function returns `digest_length`. When in doubt, callers
+can pass an array of size HACL_BLAKE2B_32_OUT_BYTES, then use the return value
+to see how many bytes were actually written.
 */
-void Hacl_Hash_Blake2b_digest(Hacl_Hash_Blake2b_state_t *state, uint8_t *output);
+uint8_t Hacl_Hash_Blake2b_digest(Hacl_Hash_Blake2b_state_t *s, uint8_t *dst);
+
+Hacl_Hash_Blake2b_index Hacl_Hash_Blake2b_info(Hacl_Hash_Blake2b_state_t *s);
 
 /**
   Free state function when there is no key
@@ -198,10 +225,10 @@ Hacl_Hash_Blake2b_hash_with_key(
 Write the BLAKE2b digest of message `input` using key `key` and
 parameters `params` into `output`. The `key` array must be of length
 `params.key_length`. The `output` array must be of length
-`params.digest_length`. 
+`params.digest_length`.
 */
 void
-Hacl_Hash_Blake2b_hash_with_key_and_paramas(
+Hacl_Hash_Blake2b_hash_with_key_and_params(
   uint8_t *output,
   uint8_t *input,
   uint32_t input_len,
diff --git a/include/Hacl_Hash_Blake2b_Simd256.h b/include/Hacl_Hash_Blake2b_Simd256.h
index af309dc8..f1799e25 100644
--- a/include/Hacl_Hash_Blake2b_Simd256.h
+++ b/include/Hacl_Hash_Blake2b_Simd256.h
@@ -40,6 +40,16 @@ extern "C" {
 #include "Hacl_Hash_Blake2b.h"
 #include "libintvector.h"
 
+#define HACL_HASH_BLAKE2B_SIMD256_BLOCK_BYTES (128U)
+
+#define HACL_HASH_BLAKE2B_SIMD256_OUT_BYTES (64U)
+
+#define HACL_HASH_BLAKE2B_SIMD256_KEY_BYTES (64U)
+
+#define HACL_HASH_BLAKE2B_SIMD256_SALT_BYTES (16U)
+
+#define HACL_HASH_BLAKE2B_SIMD256_PERSONAL_BYTES (16U)
+
 typedef struct K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256__s
 {
   Lib_IntVector_Intrinsics_vec256 *fst;
@@ -51,7 +61,8 @@ typedef struct Hacl_Hash_Blake2b_Simd256_block_state_t_s
 {
   uint8_t fst;
   uint8_t snd;
-  K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_ thd;
+  bool thd;
+  K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_ f3;
 }
 Hacl_Hash_Blake2b_Simd256_block_state_t;
 
@@ -64,34 +75,54 @@ typedef struct Hacl_Hash_Blake2b_Simd256_state_t_s
 Hacl_Hash_Blake2b_Simd256_state_t;
 
 /**
- State allocation function when there are parameters and a key. The
-length of the key k MUST match the value of the field key_length in the
-parameters. Furthermore, there is a static (not dynamically checked) requirement
-that key_length does not exceed max_key (256 for S, 64 for B).)
+ General-purpose allocation function that gives control over all
+Blake2 parameters, including the key. Further resettings of the state SHALL be
+done with `reset_with_params_and_key`, and SHALL feature the exact same values
+for the `key_length` and `digest_length` fields as passed here. In other words,
+once you commit to a digest and key length, the only way to change these
+parameters is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The length of the key k MUST match the value of the field key_length in the
+  parameters.
+- The key_length must not exceed 256 for S, 64 for B.
+- The digest_length must not exceed 256 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2b_Simd256_state_t
 *Hacl_Hash_Blake2b_Simd256_malloc_with_params_and_key(
   Hacl_Hash_Blake2b_blake2_params *p,
+  bool last_node,
   uint8_t *k
 );
 
 /**
- State allocation function when there is just a custom key. All
-other parameters are set to their respective default values, meaning the output
-length is the maximum allowed output (256 for S, 64 for B).
+ Specialized allocation function that picks default values for all
+parameters, except for the key_length. Further resettings of the state SHALL be
+done with `reset_with_key`, and SHALL feature the exact same key length `kk` as
+passed here. In other words, once you commit to a key length, the only way to
+change this parameter is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The key_length must not exceed 256 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2b_Simd256_state_t
 *Hacl_Hash_Blake2b_Simd256_malloc_with_key0(uint8_t *k, uint8_t kk);
 
 /**
-  State allocation function when there is no key
+ Specialized allocation function that picks default values for all
+parameters, and has no key. Effectively, this is what you want if you intend to
+use Blake2 as a hash function. Further resettings of the state SHALL be done with `reset`.
 */
 Hacl_Hash_Blake2b_Simd256_state_t *Hacl_Hash_Blake2b_Simd256_malloc(void);
 
 /**
- Re-initialization function. The reinitialization API is tricky --
-you MUST reuse the same original parameters for digest (output) length and key
-length.
+ General-purpose re-initialization function with parameters and
+key. You cannot change digest_length, key_length, or last_node, meaning those values in
+the parameters object must be the same as originally decided via one of the
+malloc functions. All other values of the parameter can be changed. The behavior
+is unspecified if you violate this precondition.
 */
 void
 Hacl_Hash_Blake2b_Simd256_reset_with_key_and_params(
@@ -101,21 +132,27 @@ Hacl_Hash_Blake2b_Simd256_reset_with_key_and_params(
 );
 
 /**
- Re-initialization function when there is a key. Note that the key
-size is not allowed to change, which is why this function does not take a key
-length -- the key has to be same key size that was originally passed to
-`malloc_with_key`
+ Specialized-purpose re-initialization function with no parameters,
+and a key. The key length must be the same as originally decided via your choice
+of malloc function. All other parameters are reset to their default values. The
+original call to malloc MUST have set digest_length to the default value. The
+behavior is unspecified if you violate this precondition.
 */
 void
 Hacl_Hash_Blake2b_Simd256_reset_with_key(Hacl_Hash_Blake2b_Simd256_state_t *s, uint8_t *k);
 
 /**
-  Re-initialization function when there is no key
+ Specialized-purpose re-initialization function with no parameters
+and no key. This is what you want if you intend to use Blake2 as a hash
+function. The key length and digest length must have been set to their
+respective default values via your choice of malloc function (always true if you
+used `malloc`). All other parameters are reset to their default values. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2b_Simd256_reset(Hacl_Hash_Blake2b_Simd256_state_t *s);
 
 /**
-  Update function when there is no key; 0 = success, 1 = max length exceeded
+  Update function; 0 = success, 1 = max length exceeded
 */
 Hacl_Streaming_Types_error_code
 Hacl_Hash_Blake2b_Simd256_update(
@@ -125,10 +162,19 @@ Hacl_Hash_Blake2b_Simd256_update(
 );
 
 /**
-  Finish function when there is no key
+ Digest function. This function expects the `output` array to hold
+at least `digest_length` bytes, where `digest_length` was determined by your
+choice of `malloc` function. Concretely, if you used `malloc` or
+`malloc_with_key`, then the expected length is 256 for S, or 64 for B (default
+digest length). If you used `malloc_with_params_and_key`, then the expected
+length is whatever you chose for the `digest_length` field of your parameters.
+For convenience, this function returns `digest_length`. When in doubt, callers
+can pass an array of size HACL_BLAKE2B_256_OUT_BYTES, then use the return value
+to see how many bytes were actually written.
 */
-void
-Hacl_Hash_Blake2b_Simd256_digest(Hacl_Hash_Blake2b_Simd256_state_t *state, uint8_t *output);
+uint8_t Hacl_Hash_Blake2b_Simd256_digest(Hacl_Hash_Blake2b_Simd256_state_t *s, uint8_t *dst);
+
+Hacl_Hash_Blake2b_index Hacl_Hash_Blake2b_Simd256_info(Hacl_Hash_Blake2b_Simd256_state_t *s);
 
 /**
   Free state function when there is no key
@@ -136,7 +182,7 @@ Hacl_Hash_Blake2b_Simd256_digest(Hacl_Hash_Blake2b_Simd256_state_t *state, uint8
 void Hacl_Hash_Blake2b_Simd256_free(Hacl_Hash_Blake2b_Simd256_state_t *state);
 
 /**
-  Copying. The key length (or absence thereof) must match between source and destination.
+  Copying. This preserves all parameters.
 */
 Hacl_Hash_Blake2b_Simd256_state_t
 *Hacl_Hash_Blake2b_Simd256_copy(Hacl_Hash_Blake2b_Simd256_state_t *state);
@@ -161,8 +207,14 @@ Hacl_Hash_Blake2b_Simd256_hash_with_key(
   uint32_t key_len
 );
 
+/**
+Write the BLAKE2b digest of message `input` using key `key` and
+parameters `params` into `output`. The `key` array must be of length
+`params.key_length`. The `output` array must be of length
+`params.digest_length`.
+*/
 void
-Hacl_Hash_Blake2b_Simd256_hash_with_key_and_paramas(
+Hacl_Hash_Blake2b_Simd256_hash_with_key_and_params(
   uint8_t *output,
   uint8_t *input,
   uint32_t input_len,
diff --git a/include/Hacl_Hash_Blake2s.h b/include/Hacl_Hash_Blake2s.h
index ac783473..870f1edc 100644
--- a/include/Hacl_Hash_Blake2s.h
+++ b/include/Hacl_Hash_Blake2s.h
@@ -38,6 +38,16 @@ extern "C" {
 #include "Hacl_Streaming_Types.h"
 #include "Hacl_Hash_Blake2b.h"
 
+#define HACL_HASH_BLAKE2S_BLOCK_BYTES (64U)
+
+#define HACL_HASH_BLAKE2S_OUT_BYTES (32U)
+
+#define HACL_HASH_BLAKE2S_KEY_BYTES (32U)
+
+#define HACL_HASH_BLAKE2S_SALT_BYTES (8U)
+
+#define HACL_HASH_BLAKE2S_PERSONAL_BYTES (8U)
+
 typedef struct K____uint32_t___uint32_t__s
 {
   uint32_t *fst;
@@ -49,7 +59,8 @@ typedef struct Hacl_Hash_Blake2s_block_state_t_s
 {
   uint8_t fst;
   uint8_t snd;
-  K____uint32_t___uint32_t_ thd;
+  bool thd;
+  K____uint32_t___uint32_t_ f3;
 }
 Hacl_Hash_Blake2s_block_state_t;
 
@@ -62,30 +73,53 @@ typedef struct Hacl_Hash_Blake2s_state_t_s
 Hacl_Hash_Blake2s_state_t;
 
 /**
- State allocation function when there are parameters and a key. The
-length of the key k MUST match the value of the field key_length in the
-parameters. Furthermore, there is a static (not dynamically checked) requirement
-that key_length does not exceed max_key (32 for S, 64 for B).)
+ General-purpose allocation function that gives control over all
+Blake2 parameters, including the key. Further resettings of the state SHALL be
+done with `reset_with_params_and_key`, and SHALL feature the exact same values
+for the `key_length` and `digest_length` fields as passed here. In other words,
+once you commit to a digest and key length, the only way to change these
+parameters is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The length of the key k MUST match the value of the field key_length in the
+  parameters.
+- The key_length must not exceed 32 for S, 64 for B.
+- The digest_length must not exceed 32 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2s_state_t
-*Hacl_Hash_Blake2s_malloc_with_params_and_key(Hacl_Hash_Blake2b_blake2_params *p, uint8_t *k);
+*Hacl_Hash_Blake2s_malloc_with_params_and_key(
+  Hacl_Hash_Blake2b_blake2_params *p,
+  bool last_node,
+  uint8_t *k
+);
 
 /**
- State allocation function when there is just a custom key. All
-other parameters are set to their respective default values, meaning the output
-length is the maximum allowed output (32 for S, 64 for B).
+ Specialized allocation function that picks default values for all
+parameters, except for the key_length. Further resettings of the state SHALL be
+done with `reset_with_key`, and SHALL feature the exact same key length `kk` as
+passed here. In other words, once you commit to a key length, the only way to
+change this parameter is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The key_length must not exceed 32 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_malloc_with_key(uint8_t *k, uint8_t kk);
 
 /**
-  State allocation function when there is no key
+ Specialized allocation function that picks default values for all
+parameters, and has no key. Effectively, this is what you want if you intend to
+use Blake2 as a hash function. Further resettings of the state SHALL be done with `reset`.
 */
 Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_malloc(void);
 
 /**
- Re-initialization function. The reinitialization API is tricky --
-you MUST reuse the same original parameters for digest (output) length and key
-length.
+ General-purpose re-initialization function with parameters and
+key. You cannot change digest_length, key_length, or last_node, meaning those values in
+the parameters object must be the same as originally decided via one of the
+malloc functions. All other values of the parameter can be changed. The behavior
+is unspecified if you violate this precondition.
 */
 void
 Hacl_Hash_Blake2s_reset_with_key_and_params(
@@ -95,28 +129,44 @@ Hacl_Hash_Blake2s_reset_with_key_and_params(
 );
 
 /**
- Re-initialization function when there is a key. Note that the key
-size is not allowed to change, which is why this function does not take a key
-length -- the key has to be same key size that was originally passed to
-`malloc_with_key`
+ Specialized-purpose re-initialization function with no parameters,
+and a key. The key length must be the same as originally decided via your choice
+of malloc function. All other parameters are reset to their default values. The
+original call to malloc MUST have set digest_length to the default value. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2s_reset_with_key(Hacl_Hash_Blake2s_state_t *s, uint8_t *k);
 
 /**
-  Re-initialization function when there is no key
+ Specialized-purpose re-initialization function with no parameters
+and no key. This is what you want if you intend to use Blake2 as a hash
+function. The key length and digest length must have been set to their
+respective default values via your choice of malloc function (always true if you
+used `malloc`). All other parameters are reset to their default values. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2s_reset(Hacl_Hash_Blake2s_state_t *s);
 
 /**
-  Update function when there is no key; 0 = success, 1 = max length exceeded
+  Update function; 0 = success, 1 = max length exceeded
 */
 Hacl_Streaming_Types_error_code
 Hacl_Hash_Blake2s_update(Hacl_Hash_Blake2s_state_t *state, uint8_t *chunk, uint32_t chunk_len);
 
 /**
-  Finish function when there is no key
+ Digest function. This function expects the `output` array to hold
+at least `digest_length` bytes, where `digest_length` was determined by your
+choice of `malloc` function. Concretely, if you used `malloc` or
+`malloc_with_key`, then the expected length is 32 for S, or 64 for B (default
+digest length). If you used `malloc_with_params_and_key`, then the expected
+length is whatever you chose for the `digest_length` field of your parameters.
+For convenience, this function returns `digest_length`. When in doubt, callers
+can pass an array of size HACL_BLAKE2S_32_OUT_BYTES, then use the return value
+to see how many bytes were actually written.
 */
-void Hacl_Hash_Blake2s_digest(Hacl_Hash_Blake2s_state_t *state, uint8_t *output);
+uint8_t Hacl_Hash_Blake2s_digest(Hacl_Hash_Blake2s_state_t *s, uint8_t *dst);
+
+Hacl_Hash_Blake2b_index Hacl_Hash_Blake2s_info(Hacl_Hash_Blake2s_state_t *s);
 
 /**
   Free state function when there is no key
@@ -124,7 +174,7 @@ void Hacl_Hash_Blake2s_digest(Hacl_Hash_Blake2s_state_t *state, uint8_t *output)
 void Hacl_Hash_Blake2s_free(Hacl_Hash_Blake2s_state_t *state);
 
 /**
-  Copying. The key length (or absence thereof) must match between source and destination.
+  Copying. This preserves all parameters.
 */
 Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_copy(Hacl_Hash_Blake2s_state_t *state);
 
@@ -148,8 +198,14 @@ Hacl_Hash_Blake2s_hash_with_key(
   uint32_t key_len
 );
 
+/**
+Write the BLAKE2s digest of message `input` using key `key` and
+parameters `params` into `output`. The `key` array must be of length
+`params.key_length`. The `output` array must be of length
+`params.digest_length`.
+*/
 void
-Hacl_Hash_Blake2s_hash_with_key_and_paramas(
+Hacl_Hash_Blake2s_hash_with_key_and_params(
   uint8_t *output,
   uint8_t *input,
   uint32_t input_len,
diff --git a/include/Hacl_Hash_Blake2s_Simd128.h b/include/Hacl_Hash_Blake2s_Simd128.h
index d725ee86..2bae1c8e 100644
--- a/include/Hacl_Hash_Blake2s_Simd128.h
+++ b/include/Hacl_Hash_Blake2s_Simd128.h
@@ -39,6 +39,16 @@ extern "C" {
 #include "Hacl_Hash_Blake2b.h"
 #include "libintvector.h"
 
+#define HACL_HASH_BLAKE2S_SIMD128_BLOCK_BYTES (64U)
+
+#define HACL_HASH_BLAKE2S_SIMD128_OUT_BYTES (32U)
+
+#define HACL_HASH_BLAKE2S_SIMD128_KEY_BYTES (32U)
+
+#define HACL_HASH_BLAKE2S_SIMD128_SALT_BYTES (8U)
+
+#define HACL_HASH_BLAKE2S_SIMD128_PERSONAL_BYTES (8U)
+
 typedef struct K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128__s
 {
   Lib_IntVector_Intrinsics_vec128 *fst;
@@ -50,7 +60,8 @@ typedef struct Hacl_Hash_Blake2s_Simd128_block_state_t_s
 {
   uint8_t fst;
   uint8_t snd;
-  K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_ thd;
+  bool thd;
+  K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_ f3;
 }
 Hacl_Hash_Blake2s_Simd128_block_state_t;
 
@@ -63,34 +74,54 @@ typedef struct Hacl_Hash_Blake2s_Simd128_state_t_s
 Hacl_Hash_Blake2s_Simd128_state_t;
 
 /**
- State allocation function when there are parameters and a key. The
-length of the key k MUST match the value of the field key_length in the
-parameters. Furthermore, there is a static (not dynamically checked) requirement
-that key_length does not exceed max_key (128 for S, 64 for B).)
+ General-purpose allocation function that gives control over all
+Blake2 parameters, including the key. Further resettings of the state SHALL be
+done with `reset_with_params_and_key`, and SHALL feature the exact same values
+for the `key_length` and `digest_length` fields as passed here. In other words,
+once you commit to a digest and key length, the only way to change these
+parameters is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The length of the key k MUST match the value of the field key_length in the
+  parameters.
+- The key_length must not exceed 128 for S, 64 for B.
+- The digest_length must not exceed 128 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2s_Simd128_state_t
 *Hacl_Hash_Blake2s_Simd128_malloc_with_params_and_key(
   Hacl_Hash_Blake2b_blake2_params *p,
+  bool last_node,
   uint8_t *k
 );
 
 /**
- State allocation function when there is just a custom key. All
-other parameters are set to their respective default values, meaning the output
-length is the maximum allowed output (128 for S, 64 for B).
+ Specialized allocation function that picks default values for all
+parameters, except for the key_length. Further resettings of the state SHALL be
+done with `reset_with_key`, and SHALL feature the exact same key length `kk` as
+passed here. In other words, once you commit to a key length, the only way to
+change this parameter is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The key_length must not exceed 128 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2s_Simd128_state_t
 *Hacl_Hash_Blake2s_Simd128_malloc_with_key0(uint8_t *k, uint8_t kk);
 
 /**
-  State allocation function when there is no key
+ Specialized allocation function that picks default values for all
+parameters, and has no key. Effectively, this is what you want if you intend to
+use Blake2 as a hash function. Further resettings of the state SHALL be done with `reset`.
 */
 Hacl_Hash_Blake2s_Simd128_state_t *Hacl_Hash_Blake2s_Simd128_malloc(void);
 
 /**
- Re-initialization function. The reinitialization API is tricky --
-you MUST reuse the same original parameters for digest (output) length and key
-length.
+ General-purpose re-initialization function with parameters and
+key. You cannot change digest_length, key_length, or last_node, meaning those values in
+the parameters object must be the same as originally decided via one of the
+malloc functions. All other values of the parameter can be changed. The behavior
+is unspecified if you violate this precondition.
 */
 void
 Hacl_Hash_Blake2s_Simd128_reset_with_key_and_params(
@@ -100,21 +131,27 @@ Hacl_Hash_Blake2s_Simd128_reset_with_key_and_params(
 );
 
 /**
- Re-initialization function when there is a key. Note that the key
-size is not allowed to change, which is why this function does not take a key
-length -- the key has to be same key size that was originally passed to
-`malloc_with_key`
+ Specialized-purpose re-initialization function with no parameters,
+and a key. The key length must be the same as originally decided via your choice
+of malloc function. All other parameters are reset to their default values. The
+original call to malloc MUST have set digest_length to the default value. The
+behavior is unspecified if you violate this precondition.
 */
 void
 Hacl_Hash_Blake2s_Simd128_reset_with_key(Hacl_Hash_Blake2s_Simd128_state_t *s, uint8_t *k);
 
 /**
-  Re-initialization function when there is no key
+ Specialized-purpose re-initialization function with no parameters
+and no key. This is what you want if you intend to use Blake2 as a hash
+function. The key length and digest length must have been set to their
+respective default values via your choice of malloc function (always true if you
+used `malloc`). All other parameters are reset to their default values. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2s_Simd128_reset(Hacl_Hash_Blake2s_Simd128_state_t *s);
 
 /**
-  Update function when there is no key; 0 = success, 1 = max length exceeded
+  Update function; 0 = success, 1 = max length exceeded
 */
 Hacl_Streaming_Types_error_code
 Hacl_Hash_Blake2s_Simd128_update(
@@ -124,10 +161,19 @@ Hacl_Hash_Blake2s_Simd128_update(
 );
 
 /**
-  Finish function when there is no key
+ Digest function. This function expects the `output` array to hold
+at least `digest_length` bytes, where `digest_length` was determined by your
+choice of `malloc` function. Concretely, if you used `malloc` or
+`malloc_with_key`, then the expected length is 128 for S, or 64 for B (default
+digest length). If you used `malloc_with_params_and_key`, then the expected
+length is whatever you chose for the `digest_length` field of your parameters.
+For convenience, this function returns `digest_length`. When in doubt, callers
+can pass an array of size HACL_BLAKE2S_128_OUT_BYTES, then use the return value
+to see how many bytes were actually written.
 */
-void
-Hacl_Hash_Blake2s_Simd128_digest(Hacl_Hash_Blake2s_Simd128_state_t *state, uint8_t *output);
+uint8_t Hacl_Hash_Blake2s_Simd128_digest(Hacl_Hash_Blake2s_Simd128_state_t *s, uint8_t *dst);
+
+Hacl_Hash_Blake2b_index Hacl_Hash_Blake2s_Simd128_info(Hacl_Hash_Blake2s_Simd128_state_t *s);
 
 /**
   Free state function when there is no key
@@ -135,7 +181,7 @@ Hacl_Hash_Blake2s_Simd128_digest(Hacl_Hash_Blake2s_Simd128_state_t *state, uint8
 void Hacl_Hash_Blake2s_Simd128_free(Hacl_Hash_Blake2s_Simd128_state_t *state);
 
 /**
-  Copying. The key length (or absence thereof) must match between source and destination.
+  Copying. This preserves all parameters.
 */
 Hacl_Hash_Blake2s_Simd128_state_t
 *Hacl_Hash_Blake2s_Simd128_copy(Hacl_Hash_Blake2s_Simd128_state_t *state);
@@ -160,8 +206,14 @@ Hacl_Hash_Blake2s_Simd128_hash_with_key(
   uint32_t key_len
 );
 
+/**
+Write the BLAKE2s digest of message `input` using key `key` and
+parameters `params` into `output`. The `key` array must be of length
+`params.key_length`. The `output` array must be of length
+`params.digest_length`.
+*/
 void
-Hacl_Hash_Blake2s_Simd128_hash_with_key_and_paramas(
+Hacl_Hash_Blake2s_Simd128_hash_with_key_and_params(
   uint8_t *output,
   uint8_t *input,
   uint32_t input_len,
diff --git a/include/Hacl_Hash_SHA3.h b/include/Hacl_Hash_SHA3.h
index 8fb78fcd..18f23d8d 100644
--- a/include/Hacl_Hash_SHA3.h
+++ b/include/Hacl_Hash_SHA3.h
@@ -117,7 +117,7 @@ void Hacl_Hash_SHA3_state_free(uint64_t *s);
 Absorb number of input blocks and write the output state
 
   This function is intended to receive a hash state and input buffer.
-  It prcoesses an input of multiple of 168-bytes (SHAKE128 block size),
+  It processes an input of multiple of 168-bytes (SHAKE128 block size),
   any additional bytes of final partial block are ignored.
 
   The argument `state` (IN/OUT) points to hash state, i.e., uint64_t[25]
@@ -131,14 +131,14 @@ Hacl_Hash_SHA3_shake128_absorb_nblocks(uint64_t *state, uint8_t *input, uint32_t
 Absorb a final partial block of input and write the output state
 
   This function is intended to receive a hash state and input buffer.
-  It prcoesses a sequence of bytes at end of input buffer that is less 
+  It processes a sequence of bytes at end of input buffer that is less
   than 168-bytes (SHAKE128 block size),
   any bytes of full blocks at start of input buffer are ignored.
 
   The argument `state` (IN/OUT) points to hash state, i.e., uint64_t[25]
   The argument `input` (IN) points to `inputByteLen` bytes of valid memory,
   i.e., uint8_t[inputByteLen]
-  
+
   Note: Full size of input buffer must be passed to `inputByteLen` including
   the number of full-block bytes at start of input buffer that are ignored
 */
diff --git a/include/Hacl_Hash_SHA3_Simd256.h b/include/Hacl_Hash_SHA3_Simd256.h
index 617e8e34..72162d43 100644
--- a/include/Hacl_Hash_SHA3_Simd256.h
+++ b/include/Hacl_Hash_SHA3_Simd256.h
@@ -139,12 +139,12 @@ void Hacl_Hash_SHA3_Simd256_state_free(Lib_IntVector_Intrinsics_vec256 *s);
 Absorb number of blocks of 4 input buffers and write the output states
 
   This function is intended to receive a quadruple hash state and 4 input buffers.
-  It prcoesses an inputs of multiple of 168-bytes (SHAKE128 block size),
+  It processes an inputs of multiple of 168-bytes (SHAKE128 block size),
   any additional bytes of final partial block for each buffer are ignored.
 
   The argument `state` (IN/OUT) points to quadruple hash state,
   i.e., Lib_IntVector_Intrinsics_vec256[25]
-  The arguments `input0/input1/input2/input3` (IN) point to `inputByteLen` bytes 
+  The arguments `input0/input1/input2/input3` (IN) point to `inputByteLen` bytes
   of valid memory for each buffer, i.e., uint8_t[inputByteLen]
 */
 void
@@ -161,15 +161,15 @@ Hacl_Hash_SHA3_Simd256_shake128_absorb_nblocks(
 Absorb a final partial blocks of 4 input buffers and write the output states
 
   This function is intended to receive a quadruple hash state and 4 input buffers.
-  It prcoesses a sequence of bytes at end of each input buffer that is less 
+  It processes a sequence of bytes at end of each input buffer that is less
   than 168-bytes (SHAKE128 block size),
   any bytes of full blocks at start of input buffers are ignored.
 
   The argument `state` (IN/OUT) points to quadruple hash state,
   i.e., Lib_IntVector_Intrinsics_vec256[25]
-  The arguments `input0/input1/input2/input3` (IN) point to `inputByteLen` bytes 
+  The arguments `input0/input1/input2/input3` (IN) point to `inputByteLen` bytes
   of valid memory for each buffer, i.e., uint8_t[inputByteLen]
-  
+
   Note: Full size of input buffers must be passed to `inputByteLen` including
   the number of full-block bytes at start of each input buffer that are ignored
 */
@@ -192,7 +192,7 @@ Squeeze a quadruple hash state to 4 output buffers
 
   The argument `state` (IN) points to quadruple hash state,
   i.e., Lib_IntVector_Intrinsics_vec256[25]
-  The arguments `output0/output1/output2/output3` (OUT) point to `outputByteLen` bytes 
+  The arguments `output0/output1/output2/output3` (OUT) point to `outputByteLen` bytes
   of valid memory for each buffer, i.e., uint8_t[inputByteLen]
 */
 void
diff --git a/include/internal/Hacl_Bignum_K256.h b/include/internal/Hacl_Bignum_K256.h
index fe72fffe..d8212bab 100644
--- a/include/internal/Hacl_Bignum_K256.h
+++ b/include/internal/Hacl_Bignum_K256.h
@@ -70,11 +70,7 @@ static inline bool Hacl_K256_Field_is_felem_lt_prime_minus_order_vartime(uint64_
   uint64_t f2 = f[2U];
   uint64_t f3 = f[3U];
   uint64_t f4 = f[4U];
-  if (f4 > 0ULL)
-  {
-    return false;
-  }
-  if (f3 > 0ULL)
+  if (f4 > 0ULL || f3 > 0ULL)
   {
     return false;
   }
diff --git a/include/internal/Hacl_Hash_Blake2b.h b/include/internal/Hacl_Hash_Blake2b.h
index 6928d205..2dad4b01 100644
--- a/include/internal/Hacl_Hash_Blake2b.h
+++ b/include/internal/Hacl_Hash_Blake2b.h
@@ -38,12 +38,12 @@ extern "C" {
 #include "internal/Hacl_Impl_Blake2_Constants.h"
 #include "../Hacl_Hash_Blake2b.h"
 
-typedef struct Hacl_Hash_Blake2b_index_s
+typedef struct Hacl_Hash_Blake2b_params_and_key_s
 {
-  uint8_t key_length;
-  uint8_t digest_length;
+  Hacl_Hash_Blake2b_blake2_params *fst;
+  uint8_t *snd;
 }
-Hacl_Hash_Blake2b_index;
+Hacl_Hash_Blake2b_params_and_key;
 
 void Hacl_Hash_Blake2b_init(uint64_t *hash, uint32_t kk, uint32_t nn);
 
@@ -62,6 +62,7 @@ Hacl_Hash_Blake2b_update_last(
   uint32_t len,
   uint64_t *wv,
   uint64_t *hash,
+  bool last_node,
   FStar_UInt128_uint128 prev,
   uint32_t rem,
   uint8_t *d
@@ -69,13 +70,6 @@ Hacl_Hash_Blake2b_update_last(
 
 void Hacl_Hash_Blake2b_finish(uint32_t nn, uint8_t *output, uint64_t *hash);
 
-typedef struct K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t__s
-{
-  Hacl_Hash_Blake2b_blake2_params *fst;
-  uint8_t *snd;
-}
-K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_;
-
 #if defined(__cplusplus)
 }
 #endif
diff --git a/include/internal/Hacl_Hash_Blake2b_Simd256.h b/include/internal/Hacl_Hash_Blake2b_Simd256.h
index 4dd986b2..04b091fc 100644
--- a/include/internal/Hacl_Hash_Blake2b_Simd256.h
+++ b/include/internal/Hacl_Hash_Blake2b_Simd256.h
@@ -58,6 +58,7 @@ Hacl_Hash_Blake2b_Simd256_update_last(
   uint32_t len,
   Lib_IntVector_Intrinsics_vec256 *wv,
   Lib_IntVector_Intrinsics_vec256 *hash,
+  bool last_node,
   FStar_UInt128_uint128 prev,
   uint32_t rem,
   uint8_t *d
diff --git a/include/internal/Hacl_Hash_Blake2s.h b/include/internal/Hacl_Hash_Blake2s.h
index eccd92de..279c472e 100644
--- a/include/internal/Hacl_Hash_Blake2s.h
+++ b/include/internal/Hacl_Hash_Blake2s.h
@@ -56,6 +56,7 @@ Hacl_Hash_Blake2s_update_last(
   uint32_t len,
   uint32_t *wv,
   uint32_t *hash,
+  bool last_node,
   uint64_t prev,
   uint32_t rem,
   uint8_t *d
diff --git a/include/internal/Hacl_Hash_Blake2s_Simd128.h b/include/internal/Hacl_Hash_Blake2s_Simd128.h
index 2c422949..77505dc2 100644
--- a/include/internal/Hacl_Hash_Blake2s_Simd128.h
+++ b/include/internal/Hacl_Hash_Blake2s_Simd128.h
@@ -58,6 +58,7 @@ Hacl_Hash_Blake2s_Simd128_update_last(
   uint32_t len,
   Lib_IntVector_Intrinsics_vec128 *wv,
   Lib_IntVector_Intrinsics_vec128 *hash,
+  bool last_node,
   uint64_t prev,
   uint32_t rem,
   uint8_t *d
diff --git a/include/msvc/Hacl_Bignum32.h b/include/msvc/Hacl_Bignum32.h
index 84a839a9..709f22d9 100644
--- a/include/msvc/Hacl_Bignum32.h
+++ b/include/msvc/Hacl_Bignum32.h
@@ -56,9 +56,18 @@ of `len` unsigned 32-bit integers, i.e. uint32_t[len].
 /**
 Write `a + b mod 2 ^ (32 * len)` in `res`.
 
-  This functions returns the carry.
-
-  The arguments a, b and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len]
+  This function returns the carry.
+  
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `b` or `res`. May have exactly equal memory
+    location to `b` or `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `a` or `res`. May have exactly
+    equal memory location to `a` or `res`.
+  @param[out] res Points to `len` number of limbs where the carry is written, i.e. `uint32_t[len]`.
+    Must not partially overlap the memory locations of `a` or `b`. May have
+    exactly equal memory location to `a` or `b`.
 */
 uint32_t Hacl_Bignum32_add(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res);
 
@@ -67,82 +76,134 @@ Write `a - b mod 2 ^ (32 * len)` in `res`.
 
   This functions returns the carry.
 
-  The arguments a, b and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len]
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `b` or `res`. May have exactly
+    equal memory location to `b` or `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `a` or `res`. May have exactly
+    equal memory location to `a` or `res`.
+  @param[out] res Points to `len` number of limbs where the carry is written, i.e. `uint32_t[len]`.
+    Must not partially overlap the memory locations of `a` or `b`. May have
+    exactly equal memory location to `a` or `b`.
 */
 uint32_t Hacl_Bignum32_sub(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res);
 
 /**
 Write `(a + b) mod n` in `res`.
 
-  The arguments a, b, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • a < n
-  • b < n
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `b` or `res`. May have exactly
+    equal memory location to `b` or `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `a` or `res`. May have exactly
+    equal memory location to `a` or `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a`, `b`, and `res`.
+  @param[out] res Points to `len` number of limbs where the result is written, i.e. `uint32_t[len]`.
+    Must not partially overlap the memory locations of `a` or `b`. May have
+    exactly equal memory location to `a` or `b`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `a < n`
+    - `b < n`
 */
 void Hacl_Bignum32_add_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *b, uint32_t *res);
 
 /**
 Write `(a - b) mod n` in `res`.
 
-  The arguments a, b, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • a < n
-  • b < n
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `b` or `res`. May have exactly
+    equal memory location to `b` or `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `a` or `res`. May have exactly
+    equal memory location to `a` or `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a`, `b`, and `res`.
+  @param[out] res Points to `len` number of limbs where the result is written, i.e. `uint32_t[len]`.
+    Must not partially overlap the memory locations of `a` or `b`. May have
+    exactly equal memory location to `a` or `b`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `a < n`
+    - `b < n`
 */
 void Hacl_Bignum32_sub_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *b, uint32_t *res);
 
 /**
 Write `a * b` in `res`.
 
-  The arguments a and b are meant to be `len` limbs in size, i.e. uint32_t[len].
-  The outparam res is meant to be `2*len` limbs in size, i.e. uint32_t[2*len].
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `b` and `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `a` and `res`.
+  @param[out] res Points to `2*len` number of limbs where the result is written, i.e. `uint32_t[2*len]`.
+    Must be disjoint from the memory locations of `a` and `b`.
 */
 void Hacl_Bignum32_mul(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res);
 
 /**
 Write `a * a` in `res`.
 
-  The argument a is meant to be `len` limbs in size, i.e. uint32_t[len].
-  The outparam res is meant to be `2*len` limbs in size, i.e. uint32_t[2*len].
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[out] res Points to `2*len` number of limbs where the result is written, i.e. `uint32_t[2*len]`.
+    Must be disjoint from the memory location of `a`.
 */
 void Hacl_Bignum32_sqr(uint32_t len, uint32_t *a, uint32_t *res);
 
 /**
 Write `a mod n` in `res`.
 
-  The argument a is meant to be `2*len` limbs in size, i.e. uint32_t[2*len].
-  The argument n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  The function returns false if any of the following preconditions are violated,
-  true otherwise.
-   • 1 < n
-   • n % 2 = 1 
+  @param[in] a Points to `2*len` number of limbs, i.e. `uint32_t[2*len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `n`.
+  
+  @return `false` if any precondition is violated, `true` otherwise.
+  
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `1 < n`
+    - `n % 2 = 1`
 */
 bool Hacl_Bignum32_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *res);
 
 /**
 Write `a ^ b mod n` in `res`.
 
-  The arguments a, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  The argument b is a bignum of any size, and bBits is an upper bound on the
-  number of significant bits of b. A tighter bound results in faster execution
-  time. When in doubt, the number of bits for the bignum size is always a safe
-  default, e.g. if b is a 4096-bit bignum, bBits should be 4096.
-
-  The function is *NOT* constant-time on the argument b. See the
-  mod_exp_consttime_* functions for constant-time variants.
-
-  The function returns false if any of the following preconditions are violated,
-  true otherwise.
-   • n % 2 = 1
-   • 1 < n
-   • b < pow2 bBits
-   • a < n
+  This function is *NOT* constant-time on the argument `b`. See the
+  `mod_exp_consttime_*` functions for constant-time variants.
+
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `n` and `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `res`.
+  @param[in] b Points to a bignum of any size, with an upper bound of `bBits` number of
+    significant bits. Must be disjoint from the memory location of `res`.
+  @param[in] bBits An upper bound on the number of significant bits of `b`.
+    A tighter bound results in faster execution time. When in doubt, the number
+    of bits for the bignum size is always a safe default, e.g. if `b` is a 4096-bit
+    bignum, `bBits` should be `4096`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a`, `b`, and `n`.
+    
+  @return `false` if any preconditions are violated, `true` otherwise.
+  
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n % 2 = 1`
+    - `1 < n`
+    - `b < pow2 bBits`
+    - `a < n`
 */
 bool
 Hacl_Bignum32_mod_exp_vartime(
@@ -157,22 +218,30 @@ Hacl_Bignum32_mod_exp_vartime(
 /**
 Write `a ^ b mod n` in `res`.
 
-  The arguments a, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  The argument b is a bignum of any size, and bBits is an upper bound on the
-  number of significant bits of b. A tighter bound results in faster execution
-  time. When in doubt, the number of bits for the bignum size is always a safe
-  default, e.g. if b is a 4096-bit bignum, bBits should be 4096.
-
-  This function is constant-time over its argument b, at the cost of a slower
-  execution time than mod_exp_vartime.
-
-  The function returns false if any of the following preconditions are violated,
-  true otherwise.
-   • n % 2 = 1
-   • 1 < n
-   • b < pow2 bBits
-   • a < n
+  This function is constant-time over its argument `b`, at the cost of a slower
+  execution time than `mod_exp_vartime_*`.
+  
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `n` and `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `res`.
+  @param[in] b Points to a bignum of any size, with an upper bound of `bBits` number of
+    significant bits. Must be disjoint from the memory location of `res`.
+  @param[in] bBits An upper bound on the number of significant bits of `b`.
+    A tighter bound results in faster execution time. When in doubt, the number
+    of bits for the bignum size is always a safe default, e.g. if `b` is a 4096-bit
+    bignum, `bBits` should be `4096`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a`, `b`, and `n`.
+    
+  @return `false` if any preconditions are violated, `true` otherwise.
+
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n % 2 = 1`
+    - `1 < n`
+    - `b < pow2 bBits`
+    - `a < n`
 */
 bool
 Hacl_Bignum32_mod_exp_consttime(
@@ -187,18 +256,23 @@ Hacl_Bignum32_mod_exp_consttime(
 /**
 Write `a ^ (-1) mod n` in `res`.
 
-  The arguments a, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • n is a prime
-
-  The function returns false if any of the following preconditions are violated,
-  true otherwise.
-  • n % 2 = 1
-  • 1 < n
-  • 0 < a
-  • a < n
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `n` and `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `res`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `a` and `n`.
+    
+  @return `false` if any preconditions (except the precondition: `n` is a prime)
+    are violated, `true` otherwise.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n` is a prime
+    - `n % 2 = 1`
+    - `1 < n`
+    - `0 < a`
+    - `a < n`
 */
 bool
 Hacl_Bignum32_mod_inv_prime_vartime(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *res);
@@ -212,15 +286,16 @@ Hacl_Bignum32_mod_inv_prime_vartime(uint32_t len, uint32_t *n, uint32_t *a, uint
 /**
 Heap-allocate and initialize a montgomery context.
 
-  The argument n is meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • n % 2 = 1
-  • 1 < n
+  @param n Points to `len` number of limbs, i.e. `uint32_t[len]`.
 
-  The caller will need to call Hacl_Bignum32_mont_ctx_free on the return value
-  to avoid memory leaks.
+  @return A pointer to an allocated and initialized Montgomery context is returned.
+    Clients will need to call `Hacl_Bignum32_mont_ctx_free` on the return value to
+    avoid memory leaks.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n % 2 = 1`
+    - `1 < n`
 */
 Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32
 *Hacl_Bignum32_mont_ctx_init(uint32_t len, uint32_t *n);
@@ -228,16 +303,18 @@ Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32
 /**
 Deallocate the memory previously allocated by Hacl_Bignum32_mont_ctx_init.
 
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
+  @param k Points to a Montgomery context obtained through `Hacl_Bignum32_mont_ctx_init`.
 */
 void Hacl_Bignum32_mont_ctx_free(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k);
 
 /**
 Write `a mod n` in `res`.
 
-  The argument a is meant to be `2*len` limbs in size, i.e. uint32_t[2*len].
-  The outparam res is meant to be `len` limbs in size, i.e. uint32_t[len].
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
+  @param[in] k Points to a Montgomery context obtained from `Hacl_Bignum32_mont_ctx_init`.
+  @param[in] a Points to `2*len` number of limbs, i.e. `uint32_t[2*len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `a`.
 */
 void
 Hacl_Bignum32_mod_precomp(
@@ -249,21 +326,25 @@ Hacl_Bignum32_mod_precomp(
 /**
 Write `a ^ b mod n` in `res`.
 
-  The arguments a and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
-
-  The argument b is a bignum of any size, and bBits is an upper bound on the
-  number of significant bits of b. A tighter bound results in faster execution
-  time. When in doubt, the number of bits for the bignum size is always a safe
-  default, e.g. if b is a 4096-bit bignum, bBits should be 4096.
-
-  The function is *NOT* constant-time on the argument b. See the
-  mod_exp_consttime_* functions for constant-time variants.
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • b < pow2 bBits
-  • a < n
+  This function is *NOT* constant-time on the argument `b`. See the
+  `mod_exp_consttime_*` functions for constant-time variants.
+
+  @param[in] k Points to a Montgomery context obtained from `Hacl_Bignum32_mont_ctx_init`.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[in] b Points to a bignum of any size, with an upper bound of `bBits` number of
+    significant bits. Must be disjoint from the memory location of `res`.
+  @param[in] bBits An upper bound on the number of significant bits of `b`.
+    A tighter bound results in faster execution time. When in doubt, the number
+    of bits for the bignum size is always a safe default, e.g. if `b` is a 4096-bit
+    bignum, `bBits` should be `4096`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `b`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `b < pow2 bBits`
+    - `a < n`
 */
 void
 Hacl_Bignum32_mod_exp_vartime_precomp(
@@ -277,21 +358,25 @@ Hacl_Bignum32_mod_exp_vartime_precomp(
 /**
 Write `a ^ b mod n` in `res`.
 
-  The arguments a and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
-
-  The argument b is a bignum of any size, and bBits is an upper bound on the
-  number of significant bits of b. A tighter bound results in faster execution
-  time. When in doubt, the number of bits for the bignum size is always a safe
-  default, e.g. if b is a 4096-bit bignum, bBits should be 4096.
-
   This function is constant-time over its argument b, at the cost of a slower
-  execution time than mod_exp_vartime_*.
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • b < pow2 bBits
-  • a < n
+  execution time than `mod_exp_vartime_*`.
+
+  @param[in] k Points to a Montgomery context obtained from `Hacl_Bignum32_mont_ctx_init`.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[in] b Points to a bignum of any size, with an upper bound of `bBits` number of
+    significant bits. Must be disjoint from the memory location of `res`.
+  @param[in] bBits An upper bound on the number of significant bits of `b`.
+    A tighter bound results in faster execution time. When in doubt, the number
+    of bits for the bignum size is always a safe default, e.g. if `b` is a 4096-bit
+    bignum, `bBits` should be `4096`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `b`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `b < pow2 bBits`
+    - `a < n`
 */
 void
 Hacl_Bignum32_mod_exp_consttime_precomp(
@@ -305,14 +390,17 @@ Hacl_Bignum32_mod_exp_consttime_precomp(
 /**
 Write `a ^ (-1) mod n` in `res`.
 
-  The argument a and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • n is a prime
-  • 0 < a
-  • a < n
+  @param[in] k Points to a Montgomery context obtained through `Hacl_Bignum32_mont_ctx_init`.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `a`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n` is a prime
+    - `0 < a`
+    - `a < n`
 */
 void
 Hacl_Bignum32_mod_inv_prime_vartime_precomp(
@@ -330,42 +418,48 @@ Hacl_Bignum32_mod_inv_prime_vartime_precomp(
 /**
 Load a bid-endian bignum from memory.
 
-  The argument b points to `len` bytes of valid memory.
-  The function returns a heap-allocated bignum of size sufficient to hold the
-   result of loading b, or NULL if either the allocation failed, or the amount of
-    required memory would exceed 4GB.
-
-  If the return value is non-null, clients must eventually call free(3) on it to
-  avoid memory leaks.
+  @param len Size of `b` as number of bytes.
+  @param b Points to `len` number of bytes, i.e. `uint8_t[len]`.
+  
+  @return A heap-allocated bignum of size sufficient to hold the result of
+    loading `b`. Otherwise, `NULL`, if either the allocation failed, or the amount
+    of required memory would exceed 4GB. Clients must `free(3)` any non-null return
+    value to avoid memory leaks.
 */
 uint32_t *Hacl_Bignum32_new_bn_from_bytes_be(uint32_t len, uint8_t *b);
 
 /**
 Load a little-endian bignum from memory.
 
-  The argument b points to `len` bytes of valid memory.
-  The function returns a heap-allocated bignum of size sufficient to hold the
-   result of loading b, or NULL if either the allocation failed, or the amount of
-    required memory would exceed 4GB.
-
-  If the return value is non-null, clients must eventually call free(3) on it to
-  avoid memory leaks.
+  @param len Size of `b` as number of bytes.
+  @param b Points to `len` number of bytes, i.e. `uint8_t[len]`.
+  
+  @return A heap-allocated bignum of size sufficient to hold the result of
+    loading `b`. Otherwise, `NULL`, if either the allocation failed, or the amount
+    of required memory would exceed 4GB. Clients must `free(3)` any non-null return
+    value to avoid memory leaks.
 */
 uint32_t *Hacl_Bignum32_new_bn_from_bytes_le(uint32_t len, uint8_t *b);
 
 /**
 Serialize a bignum into big-endian memory.
 
-  The argument b points to a bignum of ⌈len / 4⌉ size.
-  The outparam res points to `len` bytes of valid memory.
+  @param[in] len Size of `b` as number of bytes.
+  @param[in] b Points to a bignum of `ceil(len/4)` size. Must be disjoint from
+    the memory location of `res`.
+  @param[out] res Points to `len` number of bytes, i.e. `uint8_t[len]`. Must be
+    disjoint from the memory location of `b`.
 */
 void Hacl_Bignum32_bn_to_bytes_be(uint32_t len, uint32_t *b, uint8_t *res);
 
 /**
 Serialize a bignum into little-endian memory.
 
-  The argument b points to a bignum of ⌈len / 4⌉ size.
-  The outparam res points to `len` bytes of valid memory.
+  @param[in] len Size of `b` as number of bytes.
+  @param[in] b Points to a bignum of `ceil(len/4)` size. Must be disjoint from
+    the memory location of `res`.
+  @param[out] res Points to `len` number of bytes, i.e. `uint8_t[len]`. Must be
+    disjoint from the memory location of `b`.
 */
 void Hacl_Bignum32_bn_to_bytes_le(uint32_t len, uint32_t *b, uint8_t *res);
 
@@ -378,14 +472,22 @@ void Hacl_Bignum32_bn_to_bytes_le(uint32_t len, uint32_t *b, uint8_t *res);
 /**
 Returns 2^32 - 1 if a < b, otherwise returns 0.
 
- The arguments a and b are meant to be `len` limbs in size, i.e. uint32_t[len].
+  @param len Number of limbs.
+  @param a Points to `len` number of limbs, i.e. `uint32_t[len]`.
+  @param b Points to `len` number of limbs, i.e. `uint32_t[len]`.
+  
+  @return `2^32 - 1` if `a < b`, otherwise, `0`.
 */
 uint32_t Hacl_Bignum32_lt_mask(uint32_t len, uint32_t *a, uint32_t *b);
 
 /**
 Returns 2^32 - 1 if a = b, otherwise returns 0.
 
- The arguments a and b are meant to be `len` limbs in size, i.e. uint32_t[len].
+  @param len Number of limbs.
+  @param a Points to `len` number of limbs, i.e. `uint32_t[len]`.
+  @param b Points to `len` number of limbs, i.e. `uint32_t[len]`.
+  
+  @return `2^32 - 1` if a = b, otherwise, `0`.
 */
 uint32_t Hacl_Bignum32_eq_mask(uint32_t len, uint32_t *a, uint32_t *b);
 
diff --git a/include/msvc/Hacl_Hash_Blake2b.h b/include/msvc/Hacl_Hash_Blake2b.h
index 3403fc83..fcc2d5df 100644
--- a/include/msvc/Hacl_Hash_Blake2b.h
+++ b/include/msvc/Hacl_Hash_Blake2b.h
@@ -53,6 +53,24 @@ typedef struct Hacl_Hash_Blake2b_blake2_params_s
 }
 Hacl_Hash_Blake2b_blake2_params;
 
+typedef struct Hacl_Hash_Blake2b_index_s
+{
+  uint8_t key_length;
+  uint8_t digest_length;
+  bool last_node;
+}
+Hacl_Hash_Blake2b_index;
+
+#define HACL_HASH_BLAKE2B_BLOCK_BYTES (128U)
+
+#define HACL_HASH_BLAKE2B_OUT_BYTES (64U)
+
+#define HACL_HASH_BLAKE2B_KEY_BYTES (64U)
+
+#define HACL_HASH_BLAKE2B_SALT_BYTES (16U)
+
+#define HACL_HASH_BLAKE2B_PERSONAL_BYTES (16U)
+
 typedef struct K____uint64_t___uint64_t__s
 {
   uint64_t *fst;
@@ -64,7 +82,8 @@ typedef struct Hacl_Hash_Blake2b_block_state_t_s
 {
   uint8_t fst;
   uint8_t snd;
-  K____uint64_t___uint64_t_ thd;
+  bool thd;
+  K____uint64_t___uint64_t_ f3;
 }
 Hacl_Hash_Blake2b_block_state_t;
 
@@ -92,7 +111,11 @@ The caller must satisfy the following requirements.
 
 */
 Hacl_Hash_Blake2b_state_t
-*Hacl_Hash_Blake2b_malloc_with_params_and_key(Hacl_Hash_Blake2b_blake2_params *p, uint8_t *k);
+*Hacl_Hash_Blake2b_malloc_with_params_and_key(
+  Hacl_Hash_Blake2b_blake2_params *p,
+  bool last_node,
+  uint8_t *k
+);
 
 /**
  Specialized allocation function that picks default values for all
@@ -116,7 +139,7 @@ Hacl_Hash_Blake2b_state_t *Hacl_Hash_Blake2b_malloc(void);
 
 /**
  General-purpose re-initialization function with parameters and
-key. You cannot change digest_length or key_length, meaning those values in
+key. You cannot change digest_length, key_length, or last_node, meaning those values in
 the parameters object must be the same as originally decided via one of the
 malloc functions. All other values of the parameter can be changed. The behavior
 is unspecified if you violate this precondition.
@@ -159,10 +182,14 @@ at least `digest_length` bytes, where `digest_length` was determined by your
 choice of `malloc` function. Concretely, if you used `malloc` or
 `malloc_with_key`, then the expected length is 32 for S, or 64 for B (default
 digest length). If you used `malloc_with_params_and_key`, then the expected
-length is whatever you chose for the `digest_length` field of your
-parameters.
+length is whatever you chose for the `digest_length` field of your parameters.
+For convenience, this function returns `digest_length`. When in doubt, callers
+can pass an array of size HACL_BLAKE2B_32_OUT_BYTES, then use the return value
+to see how many bytes were actually written.
 */
-void Hacl_Hash_Blake2b_digest(Hacl_Hash_Blake2b_state_t *state, uint8_t *output);
+uint8_t Hacl_Hash_Blake2b_digest(Hacl_Hash_Blake2b_state_t *s, uint8_t *dst);
+
+Hacl_Hash_Blake2b_index Hacl_Hash_Blake2b_info(Hacl_Hash_Blake2b_state_t *s);
 
 /**
   Free state function when there is no key
@@ -198,10 +225,10 @@ Hacl_Hash_Blake2b_hash_with_key(
 Write the BLAKE2b digest of message `input` using key `key` and
 parameters `params` into `output`. The `key` array must be of length
 `params.key_length`. The `output` array must be of length
-`params.digest_length`. 
+`params.digest_length`.
 */
 void
-Hacl_Hash_Blake2b_hash_with_key_and_paramas(
+Hacl_Hash_Blake2b_hash_with_key_and_params(
   uint8_t *output,
   uint8_t *input,
   uint32_t input_len,
diff --git a/include/msvc/Hacl_Hash_Blake2b_Simd256.h b/include/msvc/Hacl_Hash_Blake2b_Simd256.h
index af309dc8..f1799e25 100644
--- a/include/msvc/Hacl_Hash_Blake2b_Simd256.h
+++ b/include/msvc/Hacl_Hash_Blake2b_Simd256.h
@@ -40,6 +40,16 @@ extern "C" {
 #include "Hacl_Hash_Blake2b.h"
 #include "libintvector.h"
 
+#define HACL_HASH_BLAKE2B_SIMD256_BLOCK_BYTES (128U)
+
+#define HACL_HASH_BLAKE2B_SIMD256_OUT_BYTES (64U)
+
+#define HACL_HASH_BLAKE2B_SIMD256_KEY_BYTES (64U)
+
+#define HACL_HASH_BLAKE2B_SIMD256_SALT_BYTES (16U)
+
+#define HACL_HASH_BLAKE2B_SIMD256_PERSONAL_BYTES (16U)
+
 typedef struct K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256__s
 {
   Lib_IntVector_Intrinsics_vec256 *fst;
@@ -51,7 +61,8 @@ typedef struct Hacl_Hash_Blake2b_Simd256_block_state_t_s
 {
   uint8_t fst;
   uint8_t snd;
-  K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_ thd;
+  bool thd;
+  K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_ f3;
 }
 Hacl_Hash_Blake2b_Simd256_block_state_t;
 
@@ -64,34 +75,54 @@ typedef struct Hacl_Hash_Blake2b_Simd256_state_t_s
 Hacl_Hash_Blake2b_Simd256_state_t;
 
 /**
- State allocation function when there are parameters and a key. The
-length of the key k MUST match the value of the field key_length in the
-parameters. Furthermore, there is a static (not dynamically checked) requirement
-that key_length does not exceed max_key (256 for S, 64 for B).)
+ General-purpose allocation function that gives control over all
+Blake2 parameters, including the key. Further resettings of the state SHALL be
+done with `reset_with_params_and_key`, and SHALL feature the exact same values
+for the `key_length` and `digest_length` fields as passed here. In other words,
+once you commit to a digest and key length, the only way to change these
+parameters is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The length of the key k MUST match the value of the field key_length in the
+  parameters.
+- The key_length must not exceed 256 for S, 64 for B.
+- The digest_length must not exceed 256 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2b_Simd256_state_t
 *Hacl_Hash_Blake2b_Simd256_malloc_with_params_and_key(
   Hacl_Hash_Blake2b_blake2_params *p,
+  bool last_node,
   uint8_t *k
 );
 
 /**
- State allocation function when there is just a custom key. All
-other parameters are set to their respective default values, meaning the output
-length is the maximum allowed output (256 for S, 64 for B).
+ Specialized allocation function that picks default values for all
+parameters, except for the key_length. Further resettings of the state SHALL be
+done with `reset_with_key`, and SHALL feature the exact same key length `kk` as
+passed here. In other words, once you commit to a key length, the only way to
+change this parameter is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The key_length must not exceed 256 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2b_Simd256_state_t
 *Hacl_Hash_Blake2b_Simd256_malloc_with_key0(uint8_t *k, uint8_t kk);
 
 /**
-  State allocation function when there is no key
+ Specialized allocation function that picks default values for all
+parameters, and has no key. Effectively, this is what you want if you intend to
+use Blake2 as a hash function. Further resettings of the state SHALL be done with `reset`.
 */
 Hacl_Hash_Blake2b_Simd256_state_t *Hacl_Hash_Blake2b_Simd256_malloc(void);
 
 /**
- Re-initialization function. The reinitialization API is tricky --
-you MUST reuse the same original parameters for digest (output) length and key
-length.
+ General-purpose re-initialization function with parameters and
+key. You cannot change digest_length, key_length, or last_node, meaning those values in
+the parameters object must be the same as originally decided via one of the
+malloc functions. All other values of the parameter can be changed. The behavior
+is unspecified if you violate this precondition.
 */
 void
 Hacl_Hash_Blake2b_Simd256_reset_with_key_and_params(
@@ -101,21 +132,27 @@ Hacl_Hash_Blake2b_Simd256_reset_with_key_and_params(
 );
 
 /**
- Re-initialization function when there is a key. Note that the key
-size is not allowed to change, which is why this function does not take a key
-length -- the key has to be same key size that was originally passed to
-`malloc_with_key`
+ Specialized-purpose re-initialization function with no parameters,
+and a key. The key length must be the same as originally decided via your choice
+of malloc function. All other parameters are reset to their default values. The
+original call to malloc MUST have set digest_length to the default value. The
+behavior is unspecified if you violate this precondition.
 */
 void
 Hacl_Hash_Blake2b_Simd256_reset_with_key(Hacl_Hash_Blake2b_Simd256_state_t *s, uint8_t *k);
 
 /**
-  Re-initialization function when there is no key
+ Specialized-purpose re-initialization function with no parameters
+and no key. This is what you want if you intend to use Blake2 as a hash
+function. The key length and digest length must have been set to their
+respective default values via your choice of malloc function (always true if you
+used `malloc`). All other parameters are reset to their default values. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2b_Simd256_reset(Hacl_Hash_Blake2b_Simd256_state_t *s);
 
 /**
-  Update function when there is no key; 0 = success, 1 = max length exceeded
+  Update function; 0 = success, 1 = max length exceeded
 */
 Hacl_Streaming_Types_error_code
 Hacl_Hash_Blake2b_Simd256_update(
@@ -125,10 +162,19 @@ Hacl_Hash_Blake2b_Simd256_update(
 );
 
 /**
-  Finish function when there is no key
+ Digest function. This function expects the `output` array to hold
+at least `digest_length` bytes, where `digest_length` was determined by your
+choice of `malloc` function. Concretely, if you used `malloc` or
+`malloc_with_key`, then the expected length is 256 for S, or 64 for B (default
+digest length). If you used `malloc_with_params_and_key`, then the expected
+length is whatever you chose for the `digest_length` field of your parameters.
+For convenience, this function returns `digest_length`. When in doubt, callers
+can pass an array of size HACL_BLAKE2B_256_OUT_BYTES, then use the return value
+to see how many bytes were actually written.
 */
-void
-Hacl_Hash_Blake2b_Simd256_digest(Hacl_Hash_Blake2b_Simd256_state_t *state, uint8_t *output);
+uint8_t Hacl_Hash_Blake2b_Simd256_digest(Hacl_Hash_Blake2b_Simd256_state_t *s, uint8_t *dst);
+
+Hacl_Hash_Blake2b_index Hacl_Hash_Blake2b_Simd256_info(Hacl_Hash_Blake2b_Simd256_state_t *s);
 
 /**
   Free state function when there is no key
@@ -136,7 +182,7 @@ Hacl_Hash_Blake2b_Simd256_digest(Hacl_Hash_Blake2b_Simd256_state_t *state, uint8
 void Hacl_Hash_Blake2b_Simd256_free(Hacl_Hash_Blake2b_Simd256_state_t *state);
 
 /**
-  Copying. The key length (or absence thereof) must match between source and destination.
+  Copying. This preserves all parameters.
 */
 Hacl_Hash_Blake2b_Simd256_state_t
 *Hacl_Hash_Blake2b_Simd256_copy(Hacl_Hash_Blake2b_Simd256_state_t *state);
@@ -161,8 +207,14 @@ Hacl_Hash_Blake2b_Simd256_hash_with_key(
   uint32_t key_len
 );
 
+/**
+Write the BLAKE2b digest of message `input` using key `key` and
+parameters `params` into `output`. The `key` array must be of length
+`params.key_length`. The `output` array must be of length
+`params.digest_length`.
+*/
 void
-Hacl_Hash_Blake2b_Simd256_hash_with_key_and_paramas(
+Hacl_Hash_Blake2b_Simd256_hash_with_key_and_params(
   uint8_t *output,
   uint8_t *input,
   uint32_t input_len,
diff --git a/include/msvc/Hacl_Hash_Blake2s.h b/include/msvc/Hacl_Hash_Blake2s.h
index ac783473..870f1edc 100644
--- a/include/msvc/Hacl_Hash_Blake2s.h
+++ b/include/msvc/Hacl_Hash_Blake2s.h
@@ -38,6 +38,16 @@ extern "C" {
 #include "Hacl_Streaming_Types.h"
 #include "Hacl_Hash_Blake2b.h"
 
+#define HACL_HASH_BLAKE2S_BLOCK_BYTES (64U)
+
+#define HACL_HASH_BLAKE2S_OUT_BYTES (32U)
+
+#define HACL_HASH_BLAKE2S_KEY_BYTES (32U)
+
+#define HACL_HASH_BLAKE2S_SALT_BYTES (8U)
+
+#define HACL_HASH_BLAKE2S_PERSONAL_BYTES (8U)
+
 typedef struct K____uint32_t___uint32_t__s
 {
   uint32_t *fst;
@@ -49,7 +59,8 @@ typedef struct Hacl_Hash_Blake2s_block_state_t_s
 {
   uint8_t fst;
   uint8_t snd;
-  K____uint32_t___uint32_t_ thd;
+  bool thd;
+  K____uint32_t___uint32_t_ f3;
 }
 Hacl_Hash_Blake2s_block_state_t;
 
@@ -62,30 +73,53 @@ typedef struct Hacl_Hash_Blake2s_state_t_s
 Hacl_Hash_Blake2s_state_t;
 
 /**
- State allocation function when there are parameters and a key. The
-length of the key k MUST match the value of the field key_length in the
-parameters. Furthermore, there is a static (not dynamically checked) requirement
-that key_length does not exceed max_key (32 for S, 64 for B).)
+ General-purpose allocation function that gives control over all
+Blake2 parameters, including the key. Further resettings of the state SHALL be
+done with `reset_with_params_and_key`, and SHALL feature the exact same values
+for the `key_length` and `digest_length` fields as passed here. In other words,
+once you commit to a digest and key length, the only way to change these
+parameters is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The length of the key k MUST match the value of the field key_length in the
+  parameters.
+- The key_length must not exceed 32 for S, 64 for B.
+- The digest_length must not exceed 32 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2s_state_t
-*Hacl_Hash_Blake2s_malloc_with_params_and_key(Hacl_Hash_Blake2b_blake2_params *p, uint8_t *k);
+*Hacl_Hash_Blake2s_malloc_with_params_and_key(
+  Hacl_Hash_Blake2b_blake2_params *p,
+  bool last_node,
+  uint8_t *k
+);
 
 /**
- State allocation function when there is just a custom key. All
-other parameters are set to their respective default values, meaning the output
-length is the maximum allowed output (32 for S, 64 for B).
+ Specialized allocation function that picks default values for all
+parameters, except for the key_length. Further resettings of the state SHALL be
+done with `reset_with_key`, and SHALL feature the exact same key length `kk` as
+passed here. In other words, once you commit to a key length, the only way to
+change this parameter is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The key_length must not exceed 32 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_malloc_with_key(uint8_t *k, uint8_t kk);
 
 /**
-  State allocation function when there is no key
+ Specialized allocation function that picks default values for all
+parameters, and has no key. Effectively, this is what you want if you intend to
+use Blake2 as a hash function. Further resettings of the state SHALL be done with `reset`.
 */
 Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_malloc(void);
 
 /**
- Re-initialization function. The reinitialization API is tricky --
-you MUST reuse the same original parameters for digest (output) length and key
-length.
+ General-purpose re-initialization function with parameters and
+key. You cannot change digest_length, key_length, or last_node, meaning those values in
+the parameters object must be the same as originally decided via one of the
+malloc functions. All other values of the parameter can be changed. The behavior
+is unspecified if you violate this precondition.
 */
 void
 Hacl_Hash_Blake2s_reset_with_key_and_params(
@@ -95,28 +129,44 @@ Hacl_Hash_Blake2s_reset_with_key_and_params(
 );
 
 /**
- Re-initialization function when there is a key. Note that the key
-size is not allowed to change, which is why this function does not take a key
-length -- the key has to be same key size that was originally passed to
-`malloc_with_key`
+ Specialized-purpose re-initialization function with no parameters,
+and a key. The key length must be the same as originally decided via your choice
+of malloc function. All other parameters are reset to their default values. The
+original call to malloc MUST have set digest_length to the default value. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2s_reset_with_key(Hacl_Hash_Blake2s_state_t *s, uint8_t *k);
 
 /**
-  Re-initialization function when there is no key
+ Specialized-purpose re-initialization function with no parameters
+and no key. This is what you want if you intend to use Blake2 as a hash
+function. The key length and digest length must have been set to their
+respective default values via your choice of malloc function (always true if you
+used `malloc`). All other parameters are reset to their default values. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2s_reset(Hacl_Hash_Blake2s_state_t *s);
 
 /**
-  Update function when there is no key; 0 = success, 1 = max length exceeded
+  Update function; 0 = success, 1 = max length exceeded
 */
 Hacl_Streaming_Types_error_code
 Hacl_Hash_Blake2s_update(Hacl_Hash_Blake2s_state_t *state, uint8_t *chunk, uint32_t chunk_len);
 
 /**
-  Finish function when there is no key
+ Digest function. This function expects the `output` array to hold
+at least `digest_length` bytes, where `digest_length` was determined by your
+choice of `malloc` function. Concretely, if you used `malloc` or
+`malloc_with_key`, then the expected length is 32 for S, or 64 for B (default
+digest length). If you used `malloc_with_params_and_key`, then the expected
+length is whatever you chose for the `digest_length` field of your parameters.
+For convenience, this function returns `digest_length`. When in doubt, callers
+can pass an array of size HACL_BLAKE2S_32_OUT_BYTES, then use the return value
+to see how many bytes were actually written.
 */
-void Hacl_Hash_Blake2s_digest(Hacl_Hash_Blake2s_state_t *state, uint8_t *output);
+uint8_t Hacl_Hash_Blake2s_digest(Hacl_Hash_Blake2s_state_t *s, uint8_t *dst);
+
+Hacl_Hash_Blake2b_index Hacl_Hash_Blake2s_info(Hacl_Hash_Blake2s_state_t *s);
 
 /**
   Free state function when there is no key
@@ -124,7 +174,7 @@ void Hacl_Hash_Blake2s_digest(Hacl_Hash_Blake2s_state_t *state, uint8_t *output)
 void Hacl_Hash_Blake2s_free(Hacl_Hash_Blake2s_state_t *state);
 
 /**
-  Copying. The key length (or absence thereof) must match between source and destination.
+  Copying. This preserves all parameters.
 */
 Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_copy(Hacl_Hash_Blake2s_state_t *state);
 
@@ -148,8 +198,14 @@ Hacl_Hash_Blake2s_hash_with_key(
   uint32_t key_len
 );
 
+/**
+Write the BLAKE2s digest of message `input` using key `key` and
+parameters `params` into `output`. The `key` array must be of length
+`params.key_length`. The `output` array must be of length
+`params.digest_length`.
+*/
 void
-Hacl_Hash_Blake2s_hash_with_key_and_paramas(
+Hacl_Hash_Blake2s_hash_with_key_and_params(
   uint8_t *output,
   uint8_t *input,
   uint32_t input_len,
diff --git a/include/msvc/Hacl_Hash_Blake2s_Simd128.h b/include/msvc/Hacl_Hash_Blake2s_Simd128.h
index d725ee86..2bae1c8e 100644
--- a/include/msvc/Hacl_Hash_Blake2s_Simd128.h
+++ b/include/msvc/Hacl_Hash_Blake2s_Simd128.h
@@ -39,6 +39,16 @@ extern "C" {
 #include "Hacl_Hash_Blake2b.h"
 #include "libintvector.h"
 
+#define HACL_HASH_BLAKE2S_SIMD128_BLOCK_BYTES (64U)
+
+#define HACL_HASH_BLAKE2S_SIMD128_OUT_BYTES (32U)
+
+#define HACL_HASH_BLAKE2S_SIMD128_KEY_BYTES (32U)
+
+#define HACL_HASH_BLAKE2S_SIMD128_SALT_BYTES (8U)
+
+#define HACL_HASH_BLAKE2S_SIMD128_PERSONAL_BYTES (8U)
+
 typedef struct K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128__s
 {
   Lib_IntVector_Intrinsics_vec128 *fst;
@@ -50,7 +60,8 @@ typedef struct Hacl_Hash_Blake2s_Simd128_block_state_t_s
 {
   uint8_t fst;
   uint8_t snd;
-  K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_ thd;
+  bool thd;
+  K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_ f3;
 }
 Hacl_Hash_Blake2s_Simd128_block_state_t;
 
@@ -63,34 +74,54 @@ typedef struct Hacl_Hash_Blake2s_Simd128_state_t_s
 Hacl_Hash_Blake2s_Simd128_state_t;
 
 /**
- State allocation function when there are parameters and a key. The
-length of the key k MUST match the value of the field key_length in the
-parameters. Furthermore, there is a static (not dynamically checked) requirement
-that key_length does not exceed max_key (128 for S, 64 for B).)
+ General-purpose allocation function that gives control over all
+Blake2 parameters, including the key. Further resettings of the state SHALL be
+done with `reset_with_params_and_key`, and SHALL feature the exact same values
+for the `key_length` and `digest_length` fields as passed here. In other words,
+once you commit to a digest and key length, the only way to change these
+parameters is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The length of the key k MUST match the value of the field key_length in the
+  parameters.
+- The key_length must not exceed 128 for S, 64 for B.
+- The digest_length must not exceed 128 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2s_Simd128_state_t
 *Hacl_Hash_Blake2s_Simd128_malloc_with_params_and_key(
   Hacl_Hash_Blake2b_blake2_params *p,
+  bool last_node,
   uint8_t *k
 );
 
 /**
- State allocation function when there is just a custom key. All
-other parameters are set to their respective default values, meaning the output
-length is the maximum allowed output (128 for S, 64 for B).
+ Specialized allocation function that picks default values for all
+parameters, except for the key_length. Further resettings of the state SHALL be
+done with `reset_with_key`, and SHALL feature the exact same key length `kk` as
+passed here. In other words, once you commit to a key length, the only way to
+change this parameter is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The key_length must not exceed 128 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2s_Simd128_state_t
 *Hacl_Hash_Blake2s_Simd128_malloc_with_key0(uint8_t *k, uint8_t kk);
 
 /**
-  State allocation function when there is no key
+ Specialized allocation function that picks default values for all
+parameters, and has no key. Effectively, this is what you want if you intend to
+use Blake2 as a hash function. Further resettings of the state SHALL be done with `reset`.
 */
 Hacl_Hash_Blake2s_Simd128_state_t *Hacl_Hash_Blake2s_Simd128_malloc(void);
 
 /**
- Re-initialization function. The reinitialization API is tricky --
-you MUST reuse the same original parameters for digest (output) length and key
-length.
+ General-purpose re-initialization function with parameters and
+key. You cannot change digest_length, key_length, or last_node, meaning those values in
+the parameters object must be the same as originally decided via one of the
+malloc functions. All other values of the parameter can be changed. The behavior
+is unspecified if you violate this precondition.
 */
 void
 Hacl_Hash_Blake2s_Simd128_reset_with_key_and_params(
@@ -100,21 +131,27 @@ Hacl_Hash_Blake2s_Simd128_reset_with_key_and_params(
 );
 
 /**
- Re-initialization function when there is a key. Note that the key
-size is not allowed to change, which is why this function does not take a key
-length -- the key has to be same key size that was originally passed to
-`malloc_with_key`
+ Specialized-purpose re-initialization function with no parameters,
+and a key. The key length must be the same as originally decided via your choice
+of malloc function. All other parameters are reset to their default values. The
+original call to malloc MUST have set digest_length to the default value. The
+behavior is unspecified if you violate this precondition.
 */
 void
 Hacl_Hash_Blake2s_Simd128_reset_with_key(Hacl_Hash_Blake2s_Simd128_state_t *s, uint8_t *k);
 
 /**
-  Re-initialization function when there is no key
+ Specialized-purpose re-initialization function with no parameters
+and no key. This is what you want if you intend to use Blake2 as a hash
+function. The key length and digest length must have been set to their
+respective default values via your choice of malloc function (always true if you
+used `malloc`). All other parameters are reset to their default values. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2s_Simd128_reset(Hacl_Hash_Blake2s_Simd128_state_t *s);
 
 /**
-  Update function when there is no key; 0 = success, 1 = max length exceeded
+  Update function; 0 = success, 1 = max length exceeded
 */
 Hacl_Streaming_Types_error_code
 Hacl_Hash_Blake2s_Simd128_update(
@@ -124,10 +161,19 @@ Hacl_Hash_Blake2s_Simd128_update(
 );
 
 /**
-  Finish function when there is no key
+ Digest function. This function expects the `output` array to hold
+at least `digest_length` bytes, where `digest_length` was determined by your
+choice of `malloc` function. Concretely, if you used `malloc` or
+`malloc_with_key`, then the expected length is 128 for S, or 64 for B (default
+digest length). If you used `malloc_with_params_and_key`, then the expected
+length is whatever you chose for the `digest_length` field of your parameters.
+For convenience, this function returns `digest_length`. When in doubt, callers
+can pass an array of size HACL_BLAKE2S_128_OUT_BYTES, then use the return value
+to see how many bytes were actually written.
 */
-void
-Hacl_Hash_Blake2s_Simd128_digest(Hacl_Hash_Blake2s_Simd128_state_t *state, uint8_t *output);
+uint8_t Hacl_Hash_Blake2s_Simd128_digest(Hacl_Hash_Blake2s_Simd128_state_t *s, uint8_t *dst);
+
+Hacl_Hash_Blake2b_index Hacl_Hash_Blake2s_Simd128_info(Hacl_Hash_Blake2s_Simd128_state_t *s);
 
 /**
   Free state function when there is no key
@@ -135,7 +181,7 @@ Hacl_Hash_Blake2s_Simd128_digest(Hacl_Hash_Blake2s_Simd128_state_t *state, uint8
 void Hacl_Hash_Blake2s_Simd128_free(Hacl_Hash_Blake2s_Simd128_state_t *state);
 
 /**
-  Copying. The key length (or absence thereof) must match between source and destination.
+  Copying. This preserves all parameters.
 */
 Hacl_Hash_Blake2s_Simd128_state_t
 *Hacl_Hash_Blake2s_Simd128_copy(Hacl_Hash_Blake2s_Simd128_state_t *state);
@@ -160,8 +206,14 @@ Hacl_Hash_Blake2s_Simd128_hash_with_key(
   uint32_t key_len
 );
 
+/**
+Write the BLAKE2s digest of message `input` using key `key` and
+parameters `params` into `output`. The `key` array must be of length
+`params.key_length`. The `output` array must be of length
+`params.digest_length`.
+*/
 void
-Hacl_Hash_Blake2s_Simd128_hash_with_key_and_paramas(
+Hacl_Hash_Blake2s_Simd128_hash_with_key_and_params(
   uint8_t *output,
   uint8_t *input,
   uint32_t input_len,
diff --git a/include/msvc/Hacl_Hash_SHA3.h b/include/msvc/Hacl_Hash_SHA3.h
index 8fb78fcd..18f23d8d 100644
--- a/include/msvc/Hacl_Hash_SHA3.h
+++ b/include/msvc/Hacl_Hash_SHA3.h
@@ -117,7 +117,7 @@ void Hacl_Hash_SHA3_state_free(uint64_t *s);
 Absorb number of input blocks and write the output state
 
   This function is intended to receive a hash state and input buffer.
-  It prcoesses an input of multiple of 168-bytes (SHAKE128 block size),
+  It processes an input of multiple of 168-bytes (SHAKE128 block size),
   any additional bytes of final partial block are ignored.
 
   The argument `state` (IN/OUT) points to hash state, i.e., uint64_t[25]
@@ -131,14 +131,14 @@ Hacl_Hash_SHA3_shake128_absorb_nblocks(uint64_t *state, uint8_t *input, uint32_t
 Absorb a final partial block of input and write the output state
 
   This function is intended to receive a hash state and input buffer.
-  It prcoesses a sequence of bytes at end of input buffer that is less 
+  It processes a sequence of bytes at end of input buffer that is less
   than 168-bytes (SHAKE128 block size),
   any bytes of full blocks at start of input buffer are ignored.
 
   The argument `state` (IN/OUT) points to hash state, i.e., uint64_t[25]
   The argument `input` (IN) points to `inputByteLen` bytes of valid memory,
   i.e., uint8_t[inputByteLen]
-  
+
   Note: Full size of input buffer must be passed to `inputByteLen` including
   the number of full-block bytes at start of input buffer that are ignored
 */
diff --git a/include/msvc/Hacl_Hash_SHA3_Simd256.h b/include/msvc/Hacl_Hash_SHA3_Simd256.h
index 617e8e34..72162d43 100644
--- a/include/msvc/Hacl_Hash_SHA3_Simd256.h
+++ b/include/msvc/Hacl_Hash_SHA3_Simd256.h
@@ -139,12 +139,12 @@ void Hacl_Hash_SHA3_Simd256_state_free(Lib_IntVector_Intrinsics_vec256 *s);
 Absorb number of blocks of 4 input buffers and write the output states
 
   This function is intended to receive a quadruple hash state and 4 input buffers.
-  It prcoesses an inputs of multiple of 168-bytes (SHAKE128 block size),
+  It processes an inputs of multiple of 168-bytes (SHAKE128 block size),
   any additional bytes of final partial block for each buffer are ignored.
 
   The argument `state` (IN/OUT) points to quadruple hash state,
   i.e., Lib_IntVector_Intrinsics_vec256[25]
-  The arguments `input0/input1/input2/input3` (IN) point to `inputByteLen` bytes 
+  The arguments `input0/input1/input2/input3` (IN) point to `inputByteLen` bytes
   of valid memory for each buffer, i.e., uint8_t[inputByteLen]
 */
 void
@@ -161,15 +161,15 @@ Hacl_Hash_SHA3_Simd256_shake128_absorb_nblocks(
 Absorb a final partial blocks of 4 input buffers and write the output states
 
   This function is intended to receive a quadruple hash state and 4 input buffers.
-  It prcoesses a sequence of bytes at end of each input buffer that is less 
+  It processes a sequence of bytes at end of each input buffer that is less
   than 168-bytes (SHAKE128 block size),
   any bytes of full blocks at start of input buffers are ignored.
 
   The argument `state` (IN/OUT) points to quadruple hash state,
   i.e., Lib_IntVector_Intrinsics_vec256[25]
-  The arguments `input0/input1/input2/input3` (IN) point to `inputByteLen` bytes 
+  The arguments `input0/input1/input2/input3` (IN) point to `inputByteLen` bytes
   of valid memory for each buffer, i.e., uint8_t[inputByteLen]
-  
+
   Note: Full size of input buffers must be passed to `inputByteLen` including
   the number of full-block bytes at start of each input buffer that are ignored
 */
@@ -192,7 +192,7 @@ Squeeze a quadruple hash state to 4 output buffers
 
   The argument `state` (IN) points to quadruple hash state,
   i.e., Lib_IntVector_Intrinsics_vec256[25]
-  The arguments `output0/output1/output2/output3` (OUT) point to `outputByteLen` bytes 
+  The arguments `output0/output1/output2/output3` (OUT) point to `outputByteLen` bytes
   of valid memory for each buffer, i.e., uint8_t[inputByteLen]
 */
 void
diff --git a/include/msvc/internal/Hacl_Hash_Blake2b.h b/include/msvc/internal/Hacl_Hash_Blake2b.h
index 6928d205..2dad4b01 100644
--- a/include/msvc/internal/Hacl_Hash_Blake2b.h
+++ b/include/msvc/internal/Hacl_Hash_Blake2b.h
@@ -38,12 +38,12 @@ extern "C" {
 #include "internal/Hacl_Impl_Blake2_Constants.h"
 #include "../Hacl_Hash_Blake2b.h"
 
-typedef struct Hacl_Hash_Blake2b_index_s
+typedef struct Hacl_Hash_Blake2b_params_and_key_s
 {
-  uint8_t key_length;
-  uint8_t digest_length;
+  Hacl_Hash_Blake2b_blake2_params *fst;
+  uint8_t *snd;
 }
-Hacl_Hash_Blake2b_index;
+Hacl_Hash_Blake2b_params_and_key;
 
 void Hacl_Hash_Blake2b_init(uint64_t *hash, uint32_t kk, uint32_t nn);
 
@@ -62,6 +62,7 @@ Hacl_Hash_Blake2b_update_last(
   uint32_t len,
   uint64_t *wv,
   uint64_t *hash,
+  bool last_node,
   FStar_UInt128_uint128 prev,
   uint32_t rem,
   uint8_t *d
@@ -69,13 +70,6 @@ Hacl_Hash_Blake2b_update_last(
 
 void Hacl_Hash_Blake2b_finish(uint32_t nn, uint8_t *output, uint64_t *hash);
 
-typedef struct K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t__s
-{
-  Hacl_Hash_Blake2b_blake2_params *fst;
-  uint8_t *snd;
-}
-K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_;
-
 #if defined(__cplusplus)
 }
 #endif
diff --git a/include/msvc/internal/Hacl_Hash_Blake2b_Simd256.h b/include/msvc/internal/Hacl_Hash_Blake2b_Simd256.h
index 4dd986b2..04b091fc 100644
--- a/include/msvc/internal/Hacl_Hash_Blake2b_Simd256.h
+++ b/include/msvc/internal/Hacl_Hash_Blake2b_Simd256.h
@@ -58,6 +58,7 @@ Hacl_Hash_Blake2b_Simd256_update_last(
   uint32_t len,
   Lib_IntVector_Intrinsics_vec256 *wv,
   Lib_IntVector_Intrinsics_vec256 *hash,
+  bool last_node,
   FStar_UInt128_uint128 prev,
   uint32_t rem,
   uint8_t *d
diff --git a/include/msvc/internal/Hacl_Hash_Blake2s.h b/include/msvc/internal/Hacl_Hash_Blake2s.h
index eccd92de..279c472e 100644
--- a/include/msvc/internal/Hacl_Hash_Blake2s.h
+++ b/include/msvc/internal/Hacl_Hash_Blake2s.h
@@ -56,6 +56,7 @@ Hacl_Hash_Blake2s_update_last(
   uint32_t len,
   uint32_t *wv,
   uint32_t *hash,
+  bool last_node,
   uint64_t prev,
   uint32_t rem,
   uint8_t *d
diff --git a/include/msvc/internal/Hacl_Hash_Blake2s_Simd128.h b/include/msvc/internal/Hacl_Hash_Blake2s_Simd128.h
index 2c422949..77505dc2 100644
--- a/include/msvc/internal/Hacl_Hash_Blake2s_Simd128.h
+++ b/include/msvc/internal/Hacl_Hash_Blake2s_Simd128.h
@@ -58,6 +58,7 @@ Hacl_Hash_Blake2s_Simd128_update_last(
   uint32_t len,
   Lib_IntVector_Intrinsics_vec128 *wv,
   Lib_IntVector_Intrinsics_vec128 *hash,
+  bool last_node,
   uint64_t prev,
   uint32_t rem,
   uint8_t *d
diff --git a/karamel/include/krml/internal/target.h b/karamel/include/krml/internal/target.h
index d4252a10..8e00f2fd 100644
--- a/karamel/include/krml/internal/target.h
+++ b/karamel/include/krml/internal/target.h
@@ -69,6 +69,14 @@
 #  endif
 #endif
 
+#ifndef KRML_ATTRIBUTE_TARGET
+#  if defined(__GNUC__)
+#    define KRML_ATTRIBUTE_TARGET(x) __attribute__((target(x)))
+#  else
+#    define KRML_ATTRIBUTE_TARGET(x)
+#  endif
+#endif
+
 #ifndef KRML_NOINLINE
 #  if defined(_MSC_VER)
 #    define KRML_NOINLINE __declspec(noinline)
@@ -82,6 +90,18 @@
 #  endif
 #endif
 
+#ifndef KRML_MUSTINLINE
+#  if defined(_MSC_VER)
+#    define KRML_MUSTINLINE inline __forceinline
+#  elif defined (__GNUC__)
+#    define KRML_MUSTINLINE inline __attribute__((always_inline))
+#  else
+#    define KRML_MUSTINLINE inline
+#    warning "The KRML_MUSTINLINE macro defaults to plain inline for this toolchain!"
+#    warning "Please locate target.h and try to fill it out with a suitable definition for this compiler."
+#  endif
+#endif
+
 #ifndef KRML_PRE_ALIGN
 #  ifdef _MSC_VER
 #    define KRML_PRE_ALIGN(X) __declspec(align(X))
diff --git a/ocaml/ctypes.depend b/ocaml/ctypes.depend
index d94fad90..237d3e42 100644
--- a/ocaml/ctypes.depend
+++ b/ocaml/ctypes.depend
@@ -1,4 +1,4 @@
-CTYPES_DEPS=lib/Hacl_Streaming_Types_stubs.cmx lib/Hacl_Streaming_Types_bindings.cmx lib/Hacl_Spec_stubs.cmx lib/Hacl_Spec_bindings.cmx lib/Hacl_Hash_Blake2b_stubs.cmx lib/Hacl_Hash_Blake2b_bindings.cmx lib/Hacl_Hash_Blake2s_stubs.cmx lib/Hacl_Hash_Blake2s_bindings.cmx lib/Hacl_Hash_Blake2b_Simd256_stubs.cmx lib/Hacl_Hash_Blake2b_Simd256_bindings.cmx lib/Hacl_Hash_Blake2s_Simd128_stubs.cmx lib/Hacl_Hash_Blake2s_Simd128_bindings.cmx lib/Hacl_Hash_Base_stubs.cmx lib/Hacl_Hash_Base_bindings.cmx lib/Hacl_Hash_SHA1_stubs.cmx lib/Hacl_Hash_SHA1_bindings.cmx lib/Hacl_Hash_SHA2_stubs.cmx lib/Hacl_Hash_SHA2_bindings.cmx lib/Hacl_HMAC_stubs.cmx lib/Hacl_HMAC_bindings.cmx lib/Hacl_HMAC_Blake2s_128_stubs.cmx lib/Hacl_HMAC_Blake2s_128_bindings.cmx lib/Hacl_HMAC_Blake2b_256_stubs.cmx lib/Hacl_HMAC_Blake2b_256_bindings.cmx lib/Hacl_Hash_SHA3_stubs.cmx lib/Hacl_Hash_SHA3_bindings.cmx lib/Hacl_SHA2_Types_stubs.cmx lib/Hacl_SHA2_Types_bindings.cmx lib/Hacl_Hash_SHA3_Simd256_stubs.cmx lib/Hacl_Hash_SHA3_Simd256_bindings.cmx lib/Hacl_Hash_MD5_stubs.cmx lib/Hacl_Hash_MD5_bindings.cmx lib/EverCrypt_Error_stubs.cmx lib/EverCrypt_Error_bindings.cmx lib/EverCrypt_AutoConfig2_stubs.cmx lib/EverCrypt_AutoConfig2_bindings.cmx lib/EverCrypt_Hash_stubs.cmx lib/EverCrypt_Hash_bindings.cmx lib/Hacl_Chacha20_stubs.cmx lib/Hacl_Chacha20_bindings.cmx lib/Hacl_Salsa20_stubs.cmx lib/Hacl_Salsa20_bindings.cmx lib/Hacl_Bignum_Base_stubs.cmx lib/Hacl_Bignum_Base_bindings.cmx lib/Hacl_Bignum_stubs.cmx lib/Hacl_Bignum_bindings.cmx lib/Hacl_Curve25519_64_stubs.cmx lib/Hacl_Curve25519_64_bindings.cmx lib/Hacl_Bignum25519_51_stubs.cmx lib/Hacl_Bignum25519_51_bindings.cmx lib/Hacl_Curve25519_51_stubs.cmx lib/Hacl_Curve25519_51_bindings.cmx lib/Hacl_MAC_Poly1305_stubs.cmx lib/Hacl_MAC_Poly1305_bindings.cmx lib/Hacl_AEAD_Chacha20Poly1305_stubs.cmx lib/Hacl_AEAD_Chacha20Poly1305_bindings.cmx lib/Hacl_MAC_Poly1305_Simd128_stubs.cmx lib/Hacl_MAC_Poly1305_Simd128_bindings.cmx lib/Hacl_Chacha20_Vec128_stubs.cmx lib/Hacl_Chacha20_Vec128_bindings.cmx lib/Hacl_AEAD_Chacha20Poly1305_Simd128_stubs.cmx lib/Hacl_AEAD_Chacha20Poly1305_Simd128_bindings.cmx lib/Hacl_MAC_Poly1305_Simd256_stubs.cmx lib/Hacl_MAC_Poly1305_Simd256_bindings.cmx lib/Hacl_Chacha20_Vec256_stubs.cmx lib/Hacl_Chacha20_Vec256_bindings.cmx lib/Hacl_AEAD_Chacha20Poly1305_Simd256_stubs.cmx lib/Hacl_AEAD_Chacha20Poly1305_Simd256_bindings.cmx lib/Hacl_Ed25519_stubs.cmx lib/Hacl_Ed25519_bindings.cmx lib/Hacl_NaCl_stubs.cmx lib/Hacl_NaCl_bindings.cmx lib/Hacl_P256_stubs.cmx lib/Hacl_P256_bindings.cmx lib/Hacl_Bignum_K256_stubs.cmx lib/Hacl_Bignum_K256_bindings.cmx lib/Hacl_K256_ECDSA_stubs.cmx lib/Hacl_K256_ECDSA_bindings.cmx lib/Hacl_Frodo_KEM_stubs.cmx lib/Hacl_Frodo_KEM_bindings.cmx lib/Hacl_HPKE_Interface_Hacl_Impl_HPKE_Hacl_Meta_HPKE_stubs.cmx lib/Hacl_HPKE_Interface_Hacl_Impl_HPKE_Hacl_Meta_HPKE_bindings.cmx lib/Hacl_IntTypes_Intrinsics_stubs.cmx lib/Hacl_IntTypes_Intrinsics_bindings.cmx lib/Hacl_IntTypes_Intrinsics_128_stubs.cmx lib/Hacl_IntTypes_Intrinsics_128_bindings.cmx lib/Hacl_RSAPSS_stubs.cmx lib/Hacl_RSAPSS_bindings.cmx lib/Hacl_FFDHE_stubs.cmx lib/Hacl_FFDHE_bindings.cmx lib/Hacl_Frodo640_stubs.cmx lib/Hacl_Frodo640_bindings.cmx lib/Hacl_HKDF_stubs.cmx lib/Hacl_HKDF_bindings.cmx lib/Hacl_HPKE_Curve51_CP128_SHA512_stubs.cmx lib/Hacl_HPKE_Curve51_CP128_SHA512_bindings.cmx lib/EverCrypt_Cipher_stubs.cmx lib/EverCrypt_Cipher_bindings.cmx lib/Hacl_GenericField32_stubs.cmx lib/Hacl_GenericField32_bindings.cmx lib/Hacl_SHA2_Vec256_stubs.cmx lib/Hacl_SHA2_Vec256_bindings.cmx lib/Hacl_EC_K256_stubs.cmx lib/Hacl_EC_K256_bindings.cmx lib/Hacl_Bignum4096_stubs.cmx lib/Hacl_Bignum4096_bindings.cmx lib/Hacl_Chacha20_Vec32_stubs.cmx lib/Hacl_Chacha20_Vec32_bindings.cmx lib/EverCrypt_Ed25519_stubs.cmx lib/EverCrypt_Ed25519_bindings.cmx lib/Hacl_Bignum4096_32_stubs.cmx lib/Hacl_Bignum4096_32_bindings.cmx lib/EverCrypt_HMAC_stubs.cmx lib/EverCrypt_HMAC_bindings.cmx lib/Hacl_HMAC_DRBG_stubs.cmx lib/Hacl_HMAC_DRBG_bindings.cmx lib/EverCrypt_DRBG_stubs.cmx lib/EverCrypt_DRBG_bindings.cmx lib/Hacl_HPKE_Curve64_CP128_SHA512_stubs.cmx lib/Hacl_HPKE_Curve64_CP128_SHA512_bindings.cmx lib/Hacl_HPKE_P256_CP128_SHA256_stubs.cmx lib/Hacl_HPKE_P256_CP128_SHA256_bindings.cmx lib/EverCrypt_Curve25519_stubs.cmx lib/EverCrypt_Curve25519_bindings.cmx lib/Hacl_HPKE_Curve51_CP256_SHA512_stubs.cmx lib/Hacl_HPKE_Curve51_CP256_SHA512_bindings.cmx lib/Hacl_Frodo976_stubs.cmx lib/Hacl_Frodo976_bindings.cmx lib/Hacl_HKDF_Blake2s_128_stubs.cmx lib/Hacl_HKDF_Blake2s_128_bindings.cmx lib/Hacl_GenericField64_stubs.cmx lib/Hacl_GenericField64_bindings.cmx lib/Hacl_Frodo1344_stubs.cmx lib/Hacl_Frodo1344_bindings.cmx lib/Hacl_HPKE_Curve64_CP256_SHA512_stubs.cmx lib/Hacl_HPKE_Curve64_CP256_SHA512_bindings.cmx lib/Hacl_Bignum32_stubs.cmx lib/Hacl_Bignum32_bindings.cmx lib/Hacl_HPKE_Curve51_CP128_SHA256_stubs.cmx lib/Hacl_HPKE_Curve51_CP128_SHA256_bindings.cmx lib/Hacl_HPKE_Curve64_CP128_SHA256_stubs.cmx lib/Hacl_HPKE_Curve64_CP128_SHA256_bindings.cmx lib/Hacl_Bignum256_32_stubs.cmx lib/Hacl_Bignum256_32_bindings.cmx lib/Hacl_SHA2_Vec128_stubs.cmx lib/Hacl_SHA2_Vec128_bindings.cmx lib/Hacl_HPKE_Curve51_CP32_SHA256_stubs.cmx lib/Hacl_HPKE_Curve51_CP32_SHA256_bindings.cmx lib/Hacl_HPKE_Curve64_CP256_SHA256_stubs.cmx lib/Hacl_HPKE_Curve64_CP256_SHA256_bindings.cmx lib/EverCrypt_Poly1305_stubs.cmx lib/EverCrypt_Poly1305_bindings.cmx lib/Hacl_HPKE_Curve51_CP32_SHA512_stubs.cmx lib/Hacl_HPKE_Curve51_CP32_SHA512_bindings.cmx lib/Hacl_HPKE_P256_CP256_SHA256_stubs.cmx lib/Hacl_HPKE_P256_CP256_SHA256_bindings.cmx lib/Hacl_HPKE_P256_CP32_SHA256_stubs.cmx lib/Hacl_HPKE_P256_CP32_SHA256_bindings.cmx lib/Hacl_Bignum64_stubs.cmx lib/Hacl_Bignum64_bindings.cmx lib/Hacl_Frodo64_stubs.cmx lib/Hacl_Frodo64_bindings.cmx lib/Hacl_HKDF_Blake2b_256_stubs.cmx lib/Hacl_HKDF_Blake2b_256_bindings.cmx lib/Hacl_HPKE_Curve64_CP32_SHA256_stubs.cmx lib/Hacl_HPKE_Curve64_CP32_SHA256_bindings.cmx lib/Hacl_HPKE_Curve64_CP32_SHA512_stubs.cmx lib/Hacl_HPKE_Curve64_CP32_SHA512_bindings.cmx lib/EverCrypt_HKDF_stubs.cmx lib/EverCrypt_HKDF_bindings.cmx lib/Hacl_EC_Ed25519_stubs.cmx lib/Hacl_EC_Ed25519_bindings.cmx lib/Hacl_HPKE_Curve51_CP256_SHA256_stubs.cmx lib/Hacl_HPKE_Curve51_CP256_SHA256_bindings.cmx lib/EverCrypt_Chacha20Poly1305_stubs.cmx lib/EverCrypt_Chacha20Poly1305_bindings.cmx lib/EverCrypt_AEAD_stubs.cmx lib/EverCrypt_AEAD_bindings.cmx lib/Hacl_Bignum256_stubs.cmx lib/Hacl_Bignum256_bindings.cmx 
+CTYPES_DEPS=lib/Hacl_Streaming_Types_stubs.cmx lib/Hacl_Streaming_Types_bindings.cmx lib/Hacl_Spec_stubs.cmx lib/Hacl_Spec_bindings.cmx lib/Hacl_Hash_Blake2b_stubs.cmx lib/Hacl_Hash_Blake2b_bindings.cmx lib/Hacl_Hash_Blake2s_stubs.cmx lib/Hacl_Hash_Blake2s_bindings.cmx lib/Hacl_Hash_Blake2b_Simd256_stubs.cmx lib/Hacl_Hash_Blake2b_Simd256_bindings.cmx lib/Hacl_Hash_Blake2s_Simd128_stubs.cmx lib/Hacl_Hash_Blake2s_Simd128_bindings.cmx lib/Hacl_Hash_Base_stubs.cmx lib/Hacl_Hash_Base_bindings.cmx lib/Hacl_Hash_SHA1_stubs.cmx lib/Hacl_Hash_SHA1_bindings.cmx lib/Hacl_Hash_SHA2_stubs.cmx lib/Hacl_Hash_SHA2_bindings.cmx lib/Hacl_HMAC_stubs.cmx lib/Hacl_HMAC_bindings.cmx lib/Hacl_HMAC_Blake2s_128_stubs.cmx lib/Hacl_HMAC_Blake2s_128_bindings.cmx lib/Hacl_HMAC_Blake2b_256_stubs.cmx lib/Hacl_HMAC_Blake2b_256_bindings.cmx lib/Hacl_Hash_SHA3_stubs.cmx lib/Hacl_Hash_SHA3_bindings.cmx lib/Hacl_SHA2_Types_stubs.cmx lib/Hacl_SHA2_Types_bindings.cmx lib/Hacl_Hash_SHA3_Simd256_stubs.cmx lib/Hacl_Hash_SHA3_Simd256_bindings.cmx lib/Hacl_Hash_MD5_stubs.cmx lib/Hacl_Hash_MD5_bindings.cmx lib/EverCrypt_Error_stubs.cmx lib/EverCrypt_Error_bindings.cmx lib/EverCrypt_AutoConfig2_stubs.cmx lib/EverCrypt_AutoConfig2_bindings.cmx lib/EverCrypt_Hash_stubs.cmx lib/EverCrypt_Hash_bindings.cmx lib/Hacl_Chacha20_stubs.cmx lib/Hacl_Chacha20_bindings.cmx lib/Hacl_Salsa20_stubs.cmx lib/Hacl_Salsa20_bindings.cmx lib/Hacl_Bignum_Base_stubs.cmx lib/Hacl_Bignum_Base_bindings.cmx lib/Hacl_Bignum_stubs.cmx lib/Hacl_Bignum_bindings.cmx lib/Hacl_Curve25519_64_stubs.cmx lib/Hacl_Curve25519_64_bindings.cmx lib/Hacl_Bignum25519_51_stubs.cmx lib/Hacl_Bignum25519_51_bindings.cmx lib/Hacl_Curve25519_51_stubs.cmx lib/Hacl_Curve25519_51_bindings.cmx lib/Hacl_MAC_Poly1305_stubs.cmx lib/Hacl_MAC_Poly1305_bindings.cmx lib/Hacl_AEAD_Chacha20Poly1305_stubs.cmx lib/Hacl_AEAD_Chacha20Poly1305_bindings.cmx lib/Hacl_MAC_Poly1305_Simd128_stubs.cmx lib/Hacl_MAC_Poly1305_Simd128_bindings.cmx lib/Hacl_Chacha20_Vec128_stubs.cmx lib/Hacl_Chacha20_Vec128_bindings.cmx lib/Hacl_AEAD_Chacha20Poly1305_Simd128_stubs.cmx lib/Hacl_AEAD_Chacha20Poly1305_Simd128_bindings.cmx lib/Hacl_MAC_Poly1305_Simd256_stubs.cmx lib/Hacl_MAC_Poly1305_Simd256_bindings.cmx lib/Hacl_Chacha20_Vec256_stubs.cmx lib/Hacl_Chacha20_Vec256_bindings.cmx lib/Hacl_AEAD_Chacha20Poly1305_Simd256_stubs.cmx lib/Hacl_AEAD_Chacha20Poly1305_Simd256_bindings.cmx lib/Hacl_Ed25519_stubs.cmx lib/Hacl_Ed25519_bindings.cmx lib/Hacl_NaCl_stubs.cmx lib/Hacl_NaCl_bindings.cmx lib/Hacl_P256_stubs.cmx lib/Hacl_P256_bindings.cmx lib/Hacl_Bignum_K256_stubs.cmx lib/Hacl_Bignum_K256_bindings.cmx lib/Hacl_K256_ECDSA_stubs.cmx lib/Hacl_K256_ECDSA_bindings.cmx lib/Hacl_Frodo_KEM_stubs.cmx lib/Hacl_Frodo_KEM_bindings.cmx lib/Hacl_HPKE_Interface_Hacl_Impl_HPKE_Hacl_Meta_HPKE_stubs.cmx lib/Hacl_HPKE_Interface_Hacl_Impl_HPKE_Hacl_Meta_HPKE_bindings.cmx lib/Hacl_IntTypes_Intrinsics_stubs.cmx lib/Hacl_IntTypes_Intrinsics_bindings.cmx lib/Hacl_IntTypes_Intrinsics_128_stubs.cmx lib/Hacl_IntTypes_Intrinsics_128_bindings.cmx lib/Hacl_RSAPSS_stubs.cmx lib/Hacl_RSAPSS_bindings.cmx lib/Hacl_FFDHE_stubs.cmx lib/Hacl_FFDHE_bindings.cmx lib/Hacl_Frodo640_stubs.cmx lib/Hacl_Frodo640_bindings.cmx lib/Hacl_HKDF_stubs.cmx lib/Hacl_HKDF_bindings.cmx lib/Hacl_HPKE_Curve51_CP128_SHA512_stubs.cmx lib/Hacl_HPKE_Curve51_CP128_SHA512_bindings.cmx lib/EverCrypt_Cipher_stubs.cmx lib/EverCrypt_Cipher_bindings.cmx lib/Hacl_GenericField32_stubs.cmx lib/Hacl_GenericField32_bindings.cmx lib/Hacl_SHA2_Vec256_stubs.cmx lib/Hacl_SHA2_Vec256_bindings.cmx lib/Hacl_EC_K256_stubs.cmx lib/Hacl_EC_K256_bindings.cmx lib/Hacl_Bignum4096_stubs.cmx lib/Hacl_Bignum4096_bindings.cmx lib/EverCrypt_Ed25519_stubs.cmx lib/EverCrypt_Ed25519_bindings.cmx lib/Hacl_Chacha20_Vec32_stubs.cmx lib/Hacl_Chacha20_Vec32_bindings.cmx lib/Hacl_Bignum4096_32_stubs.cmx lib/Hacl_Bignum4096_32_bindings.cmx lib/EverCrypt_HMAC_stubs.cmx lib/EverCrypt_HMAC_bindings.cmx lib/Hacl_HMAC_DRBG_stubs.cmx lib/Hacl_HMAC_DRBG_bindings.cmx lib/EverCrypt_DRBG_stubs.cmx lib/EverCrypt_DRBG_bindings.cmx lib/Hacl_HPKE_Curve64_CP128_SHA512_stubs.cmx lib/Hacl_HPKE_Curve64_CP128_SHA512_bindings.cmx lib/Hacl_HPKE_P256_CP128_SHA256_stubs.cmx lib/Hacl_HPKE_P256_CP128_SHA256_bindings.cmx lib/EverCrypt_Curve25519_stubs.cmx lib/EverCrypt_Curve25519_bindings.cmx lib/Hacl_HPKE_Curve51_CP256_SHA512_stubs.cmx lib/Hacl_HPKE_Curve51_CP256_SHA512_bindings.cmx lib/Hacl_Frodo976_stubs.cmx lib/Hacl_Frodo976_bindings.cmx lib/Hacl_HKDF_Blake2s_128_stubs.cmx lib/Hacl_HKDF_Blake2s_128_bindings.cmx lib/Hacl_GenericField64_stubs.cmx lib/Hacl_GenericField64_bindings.cmx lib/Hacl_Frodo1344_stubs.cmx lib/Hacl_Frodo1344_bindings.cmx lib/Hacl_HPKE_Curve64_CP256_SHA512_stubs.cmx lib/Hacl_HPKE_Curve64_CP256_SHA512_bindings.cmx lib/Hacl_Bignum32_stubs.cmx lib/Hacl_Bignum32_bindings.cmx lib/Hacl_HPKE_Curve51_CP128_SHA256_stubs.cmx lib/Hacl_HPKE_Curve51_CP128_SHA256_bindings.cmx lib/Hacl_HPKE_Curve64_CP128_SHA256_stubs.cmx lib/Hacl_HPKE_Curve64_CP128_SHA256_bindings.cmx lib/Hacl_Bignum256_32_stubs.cmx lib/Hacl_Bignum256_32_bindings.cmx lib/Hacl_SHA2_Vec128_stubs.cmx lib/Hacl_SHA2_Vec128_bindings.cmx lib/Hacl_HPKE_Curve51_CP32_SHA256_stubs.cmx lib/Hacl_HPKE_Curve51_CP32_SHA256_bindings.cmx lib/Hacl_HPKE_Curve64_CP256_SHA256_stubs.cmx lib/Hacl_HPKE_Curve64_CP256_SHA256_bindings.cmx lib/EverCrypt_Poly1305_stubs.cmx lib/EverCrypt_Poly1305_bindings.cmx lib/Hacl_HPKE_Curve51_CP32_SHA512_stubs.cmx lib/Hacl_HPKE_Curve51_CP32_SHA512_bindings.cmx lib/Hacl_HPKE_P256_CP256_SHA256_stubs.cmx lib/Hacl_HPKE_P256_CP256_SHA256_bindings.cmx lib/Hacl_HPKE_P256_CP32_SHA256_stubs.cmx lib/Hacl_HPKE_P256_CP32_SHA256_bindings.cmx lib/Hacl_Bignum64_stubs.cmx lib/Hacl_Bignum64_bindings.cmx lib/Hacl_Frodo64_stubs.cmx lib/Hacl_Frodo64_bindings.cmx lib/Hacl_HKDF_Blake2b_256_stubs.cmx lib/Hacl_HKDF_Blake2b_256_bindings.cmx lib/Hacl_HPKE_Curve64_CP32_SHA256_stubs.cmx lib/Hacl_HPKE_Curve64_CP32_SHA256_bindings.cmx lib/Hacl_HPKE_Curve64_CP32_SHA512_stubs.cmx lib/Hacl_HPKE_Curve64_CP32_SHA512_bindings.cmx lib/EverCrypt_HKDF_stubs.cmx lib/EverCrypt_HKDF_bindings.cmx lib/Hacl_EC_Ed25519_stubs.cmx lib/Hacl_EC_Ed25519_bindings.cmx lib/Hacl_HPKE_Curve51_CP256_SHA256_stubs.cmx lib/Hacl_HPKE_Curve51_CP256_SHA256_bindings.cmx lib/EverCrypt_Chacha20Poly1305_stubs.cmx lib/EverCrypt_Chacha20Poly1305_bindings.cmx lib/EverCrypt_AEAD_stubs.cmx lib/EverCrypt_AEAD_bindings.cmx lib/Hacl_Bignum256_stubs.cmx lib/Hacl_Bignum256_bindings.cmx 
 lib/Hacl_Streaming_Types_bindings.cmx: 
 lib/Hacl_Streaming_Types_bindings.cmo: 
 lib_gen/Hacl_Streaming_Types_gen.cmx: lib/Hacl_Streaming_Types_bindings.cmx
@@ -211,14 +211,14 @@ lib/Hacl_Bignum4096_bindings.cmx: lib/Hacl_Bignum_bindings.cmx lib/Hacl_Bignum_s
 lib/Hacl_Bignum4096_bindings.cmo: lib/Hacl_Bignum_bindings.cmo lib/Hacl_Bignum_stubs.cmo 
 lib_gen/Hacl_Bignum4096_gen.cmx: lib/Hacl_Bignum4096_bindings.cmx
 lib_gen/Hacl_Bignum4096_gen.exe: lib/Hacl_Bignum_bindings.cmx lib/Hacl_Bignum_stubs.cmx lib/Hacl_Bignum_c_stubs.o lib/Hacl_Bignum4096_bindings.cmx lib_gen/Hacl_Bignum4096_gen.cmx 
-lib/Hacl_Chacha20_Vec32_bindings.cmx: 
-lib/Hacl_Chacha20_Vec32_bindings.cmo: 
-lib_gen/Hacl_Chacha20_Vec32_gen.cmx: lib/Hacl_Chacha20_Vec32_bindings.cmx
-lib_gen/Hacl_Chacha20_Vec32_gen.exe: lib/Hacl_Chacha20_Vec32_bindings.cmx lib_gen/Hacl_Chacha20_Vec32_gen.cmx 
 lib/EverCrypt_Ed25519_bindings.cmx: 
 lib/EverCrypt_Ed25519_bindings.cmo: 
 lib_gen/EverCrypt_Ed25519_gen.cmx: lib/EverCrypt_Ed25519_bindings.cmx
 lib_gen/EverCrypt_Ed25519_gen.exe: lib/EverCrypt_Ed25519_bindings.cmx lib_gen/EverCrypt_Ed25519_gen.cmx 
+lib/Hacl_Chacha20_Vec32_bindings.cmx: 
+lib/Hacl_Chacha20_Vec32_bindings.cmo: 
+lib_gen/Hacl_Chacha20_Vec32_gen.cmx: lib/Hacl_Chacha20_Vec32_bindings.cmx
+lib_gen/Hacl_Chacha20_Vec32_gen.exe: lib/Hacl_Chacha20_Vec32_bindings.cmx lib_gen/Hacl_Chacha20_Vec32_gen.cmx 
 lib/Hacl_Bignum4096_32_bindings.cmx: lib/Hacl_Bignum_bindings.cmx lib/Hacl_Bignum_stubs.cmx 
 lib/Hacl_Bignum4096_32_bindings.cmo: lib/Hacl_Bignum_bindings.cmo lib/Hacl_Bignum_stubs.cmo 
 lib_gen/Hacl_Bignum4096_32_gen.cmx: lib/Hacl_Bignum4096_32_bindings.cmx
diff --git a/ocaml/lib/Hacl_Hash_Blake2b_Simd256_bindings.ml b/ocaml/lib/Hacl_Hash_Blake2b_Simd256_bindings.ml
index 1c132a7a..8fdc5be6 100644
--- a/ocaml/lib/Hacl_Hash_Blake2b_Simd256_bindings.ml
+++ b/ocaml/lib/Hacl_Hash_Blake2b_Simd256_bindings.ml
@@ -15,8 +15,8 @@ module Bindings(F:Cstubs.FOREIGN) =
               (ocaml_bytes @->
                  (uint32_t @->
                     (ocaml_bytes @-> (uint32_t @-> (returning void)))))))
-    let hacl_Hash_Blake2b_Simd256_hash_with_key_and_paramas =
-      foreign "Hacl_Hash_Blake2b_Simd256_hash_with_key_and_paramas"
+    let hacl_Hash_Blake2b_Simd256_hash_with_key_and_params =
+      foreign "Hacl_Hash_Blake2b_Simd256_hash_with_key_and_params"
         (ocaml_bytes @->
            (ocaml_bytes @->
               (uint32_t @->
diff --git a/ocaml/lib/Hacl_Hash_Blake2b_bindings.ml b/ocaml/lib/Hacl_Hash_Blake2b_bindings.ml
index 7ba4fcf6..b32dfb66 100644
--- a/ocaml/lib/Hacl_Hash_Blake2b_bindings.ml
+++ b/ocaml/lib/Hacl_Hash_Blake2b_bindings.ml
@@ -39,7 +39,20 @@ module Bindings(F:Cstubs.FOREIGN) =
       field hacl_Hash_Blake2b_index "key_length" uint8_t
     let hacl_Hash_Blake2b_index_digest_length =
       field hacl_Hash_Blake2b_index "digest_length" uint8_t
+    let hacl_Hash_Blake2b_index_last_node =
+      field hacl_Hash_Blake2b_index "last_node" bool
     let _ = seal hacl_Hash_Blake2b_index
+    type hacl_Hash_Blake2b_params_and_key =
+      [ `hacl_Hash_Blake2b_params_and_key ] structure
+    let (hacl_Hash_Blake2b_params_and_key :
+      [ `hacl_Hash_Blake2b_params_and_key ] structure typ) =
+      structure "Hacl_Hash_Blake2b_params_and_key_s"
+    let hacl_Hash_Blake2b_params_and_key_fst =
+      field hacl_Hash_Blake2b_params_and_key "fst"
+        (ptr hacl_Hash_Blake2b_blake2_params)
+    let hacl_Hash_Blake2b_params_and_key_snd =
+      field hacl_Hash_Blake2b_params_and_key "snd" (ptr uint8_t)
+    let _ = seal hacl_Hash_Blake2b_params_and_key
     let hacl_Hash_Blake2b_init =
       foreign "Hacl_Hash_Blake2b_init"
         ((ptr uint64_t) @-> (uint32_t @-> (uint32_t @-> (returning void))))
@@ -65,7 +78,9 @@ module Bindings(F:Cstubs.FOREIGN) =
     let hacl_Hash_Blake2b_block_state_t_snd =
       field hacl_Hash_Blake2b_block_state_t "snd" uint8_t
     let hacl_Hash_Blake2b_block_state_t_thd =
-      field hacl_Hash_Blake2b_block_state_t "thd" k____uint64_t___uint64_t_
+      field hacl_Hash_Blake2b_block_state_t "thd" bool
+    let hacl_Hash_Blake2b_block_state_t_f3 =
+      field hacl_Hash_Blake2b_block_state_t "f3" k____uint64_t___uint64_t_
     let _ = seal hacl_Hash_Blake2b_block_state_t
     type hacl_Hash_Blake2b_state_t = [ `hacl_Hash_Blake2b_state_t ] structure
     let (hacl_Hash_Blake2b_state_t :
@@ -82,7 +97,8 @@ module Bindings(F:Cstubs.FOREIGN) =
     let hacl_Hash_Blake2b_malloc_with_params_and_key =
       foreign "Hacl_Hash_Blake2b_malloc_with_params_and_key"
         ((ptr hacl_Hash_Blake2b_blake2_params) @->
-           (ocaml_bytes @-> (returning (ptr hacl_Hash_Blake2b_state_t))))
+           (bool @->
+              (ocaml_bytes @-> (returning (ptr hacl_Hash_Blake2b_state_t)))))
     let hacl_Hash_Blake2b_malloc_with_key =
       foreign "Hacl_Hash_Blake2b_malloc_with_key"
         (ocaml_bytes @->
@@ -110,7 +126,11 @@ module Bindings(F:Cstubs.FOREIGN) =
     let hacl_Hash_Blake2b_digest =
       foreign "Hacl_Hash_Blake2b_digest"
         ((ptr hacl_Hash_Blake2b_state_t) @->
-           (ocaml_bytes @-> (returning void)))
+           (ocaml_bytes @-> (returning uint8_t)))
+    let hacl_Hash_Blake2b_info =
+      foreign "Hacl_Hash_Blake2b_info"
+        ((ptr hacl_Hash_Blake2b_state_t) @->
+           (returning hacl_Hash_Blake2b_index))
     let hacl_Hash_Blake2b_free =
       foreign "Hacl_Hash_Blake2b_free"
         ((ptr hacl_Hash_Blake2b_state_t) @-> (returning void))
@@ -125,8 +145,8 @@ module Bindings(F:Cstubs.FOREIGN) =
               (ocaml_bytes @->
                  (uint32_t @->
                     (ocaml_bytes @-> (uint32_t @-> (returning void)))))))
-    let hacl_Hash_Blake2b_hash_with_key_and_paramas =
-      foreign "Hacl_Hash_Blake2b_hash_with_key_and_paramas"
+    let hacl_Hash_Blake2b_hash_with_key_and_params =
+      foreign "Hacl_Hash_Blake2b_hash_with_key_and_params"
         (ocaml_bytes @->
            (ocaml_bytes @->
               (uint32_t @->
diff --git a/ocaml/lib/Hacl_Hash_Blake2s_Simd128_bindings.ml b/ocaml/lib/Hacl_Hash_Blake2s_Simd128_bindings.ml
index 6533ddbc..75fbbf39 100644
--- a/ocaml/lib/Hacl_Hash_Blake2s_Simd128_bindings.ml
+++ b/ocaml/lib/Hacl_Hash_Blake2s_Simd128_bindings.ml
@@ -15,8 +15,8 @@ module Bindings(F:Cstubs.FOREIGN) =
               (ocaml_bytes @->
                  (uint32_t @->
                     (ocaml_bytes @-> (uint32_t @-> (returning void)))))))
-    let hacl_Hash_Blake2s_Simd128_hash_with_key_and_paramas =
-      foreign "Hacl_Hash_Blake2s_Simd128_hash_with_key_and_paramas"
+    let hacl_Hash_Blake2s_Simd128_hash_with_key_and_params =
+      foreign "Hacl_Hash_Blake2s_Simd128_hash_with_key_and_params"
         (ocaml_bytes @->
            (ocaml_bytes @->
               (uint32_t @->
diff --git a/ocaml/lib/Hacl_Hash_Blake2s_bindings.ml b/ocaml/lib/Hacl_Hash_Blake2s_bindings.ml
index f6c93e89..34336a6c 100644
--- a/ocaml/lib/Hacl_Hash_Blake2s_bindings.ml
+++ b/ocaml/lib/Hacl_Hash_Blake2s_bindings.ml
@@ -23,8 +23,9 @@ module Bindings(F:Cstubs.FOREIGN) =
         (uint32_t @->
            ((ptr uint32_t) @->
               ((ptr uint32_t) @->
-                 (uint64_t @->
-                    (uint32_t @-> (ocaml_bytes @-> (returning void)))))))
+                 (bool @->
+                    (uint64_t @->
+                       (uint32_t @-> (ocaml_bytes @-> (returning void))))))))
     let hacl_Hash_Blake2s_finish =
       foreign "Hacl_Hash_Blake2s_finish"
         (uint32_t @-> (ocaml_bytes @-> ((ptr uint32_t) @-> (returning void))))
@@ -47,7 +48,9 @@ module Bindings(F:Cstubs.FOREIGN) =
     let hacl_Hash_Blake2s_block_state_t_snd =
       field hacl_Hash_Blake2s_block_state_t "snd" uint8_t
     let hacl_Hash_Blake2s_block_state_t_thd =
-      field hacl_Hash_Blake2s_block_state_t "thd" k____uint32_t___uint32_t_
+      field hacl_Hash_Blake2s_block_state_t "thd" bool
+    let hacl_Hash_Blake2s_block_state_t_f3 =
+      field hacl_Hash_Blake2s_block_state_t "f3" k____uint32_t___uint32_t_
     let _ = seal hacl_Hash_Blake2s_block_state_t
     type hacl_Hash_Blake2s_state_t = [ `hacl_Hash_Blake2s_state_t ] structure
     let (hacl_Hash_Blake2s_state_t :
@@ -64,7 +67,8 @@ module Bindings(F:Cstubs.FOREIGN) =
     let hacl_Hash_Blake2s_malloc_with_params_and_key =
       foreign "Hacl_Hash_Blake2s_malloc_with_params_and_key"
         ((ptr hacl_Hash_Blake2b_blake2_params) @->
-           (ocaml_bytes @-> (returning (ptr hacl_Hash_Blake2s_state_t))))
+           (bool @->
+              (ocaml_bytes @-> (returning (ptr hacl_Hash_Blake2s_state_t)))))
     let hacl_Hash_Blake2s_malloc_with_key =
       foreign "Hacl_Hash_Blake2s_malloc_with_key"
         (ocaml_bytes @->
@@ -92,7 +96,11 @@ module Bindings(F:Cstubs.FOREIGN) =
     let hacl_Hash_Blake2s_digest =
       foreign "Hacl_Hash_Blake2s_digest"
         ((ptr hacl_Hash_Blake2s_state_t) @->
-           (ocaml_bytes @-> (returning void)))
+           (ocaml_bytes @-> (returning uint8_t)))
+    let hacl_Hash_Blake2s_info =
+      foreign "Hacl_Hash_Blake2s_info"
+        ((ptr hacl_Hash_Blake2s_state_t) @->
+           (returning hacl_Hash_Blake2b_index))
     let hacl_Hash_Blake2s_free =
       foreign "Hacl_Hash_Blake2s_free"
         ((ptr hacl_Hash_Blake2s_state_t) @-> (returning void))
@@ -107,8 +115,8 @@ module Bindings(F:Cstubs.FOREIGN) =
               (ocaml_bytes @->
                  (uint32_t @->
                     (ocaml_bytes @-> (uint32_t @-> (returning void)))))))
-    let hacl_Hash_Blake2s_hash_with_key_and_paramas =
-      foreign "Hacl_Hash_Blake2s_hash_with_key_and_paramas"
+    let hacl_Hash_Blake2s_hash_with_key_and_params =
+      foreign "Hacl_Hash_Blake2s_hash_with_key_and_params"
         (ocaml_bytes @->
            (ocaml_bytes @->
               (uint32_t @->
diff --git a/src/EverCrypt_HMAC.c b/src/EverCrypt_HMAC.c
index 90bcaaac..844aed81 100644
--- a/src/EverCrypt_HMAC.c
+++ b/src/EverCrypt_HMAC.c
@@ -620,7 +620,7 @@ EverCrypt_HMAC_compute_blake2s(
   if (data_len == 0U)
   {
     uint32_t wv[16U] = { 0U };
-    Hacl_Hash_Blake2s_update_last(64U, wv, s0, 0ULL, 64U, ipad);
+    Hacl_Hash_Blake2s_update_last(64U, wv, s0, false, 0ULL, 64U, ipad);
   }
   else
   {
@@ -655,6 +655,7 @@ EverCrypt_HMAC_compute_blake2s(
     Hacl_Hash_Blake2s_update_last(rem_len,
       wv1,
       s0,
+      false,
       (uint64_t)64U + (uint64_t)full_blocks_len,
       rem_len,
       rem);
@@ -693,6 +694,7 @@ EverCrypt_HMAC_compute_blake2s(
   Hacl_Hash_Blake2s_update_last(rem_len,
     wv1,
     s0,
+    false,
     (uint64_t)64U + (uint64_t)full_blocks_len,
     rem_len,
     rem);
@@ -757,7 +759,13 @@ EverCrypt_HMAC_compute_blake2b(
   if (data_len == 0U)
   {
     uint64_t wv[16U] = { 0U };
-    Hacl_Hash_Blake2b_update_last(128U, wv, s0, FStar_UInt128_uint64_to_uint128(0ULL), 128U, ipad);
+    Hacl_Hash_Blake2b_update_last(128U,
+      wv,
+      s0,
+      false,
+      FStar_UInt128_uint64_to_uint128(0ULL),
+      128U,
+      ipad);
   }
   else
   {
@@ -792,6 +800,7 @@ EverCrypt_HMAC_compute_blake2b(
     Hacl_Hash_Blake2b_update_last(rem_len,
       wv1,
       s0,
+      false,
       FStar_UInt128_add(FStar_UInt128_uint64_to_uint128((uint64_t)128U),
         FStar_UInt128_uint64_to_uint128((uint64_t)full_blocks_len)),
       rem_len,
@@ -831,6 +840,7 @@ EverCrypt_HMAC_compute_blake2b(
   Hacl_Hash_Blake2b_update_last(rem_len,
     wv1,
     s0,
+    false,
     FStar_UInt128_add(FStar_UInt128_uint64_to_uint128((uint64_t)128U),
       FStar_UInt128_uint64_to_uint128((uint64_t)full_blocks_len)),
     rem_len,
diff --git a/src/EverCrypt_Hash.c b/src/EverCrypt_Hash.c
index bfafa9be..153063cc 100644
--- a/src/EverCrypt_Hash.c
+++ b/src/EverCrypt_Hash.c
@@ -616,7 +616,7 @@ update_last(EverCrypt_Hash_state_s *s, uint64_t prev_len, uint8_t *last, uint32_
   {
     uint32_t *p1 = scrut.case_Blake2S_s;
     uint32_t wv[16U] = { 0U };
-    Hacl_Hash_Blake2s_update_last(last_len, wv, p1, prev_len, last_len, last);
+    Hacl_Hash_Blake2s_update_last(last_len, wv, p1, false, prev_len, last_len, last);
     return;
   }
   if (scrut.tag == Blake2S_128_s)
@@ -624,7 +624,7 @@ update_last(EverCrypt_Hash_state_s *s, uint64_t prev_len, uint8_t *last, uint32_
     Lib_IntVector_Intrinsics_vec128 *p1 = scrut.case_Blake2S_128_s;
     #if HACL_CAN_COMPILE_VEC128
     KRML_PRE_ALIGN(16) Lib_IntVector_Intrinsics_vec128 wv[4U] KRML_POST_ALIGN(16) = { 0U };
-    Hacl_Hash_Blake2s_Simd128_update_last(last_len, wv, p1, prev_len, last_len, last);
+    Hacl_Hash_Blake2s_Simd128_update_last(last_len, wv, p1, false, prev_len, last_len, last);
     return;
     #else
     KRML_MAYBE_UNUSED_VAR(p1);
@@ -638,6 +638,7 @@ update_last(EverCrypt_Hash_state_s *s, uint64_t prev_len, uint8_t *last, uint32_
     Hacl_Hash_Blake2b_update_last(last_len,
       wv,
       p1,
+      false,
       FStar_UInt128_uint64_to_uint128(prev_len),
       last_len,
       last);
@@ -651,6 +652,7 @@ update_last(EverCrypt_Hash_state_s *s, uint64_t prev_len, uint8_t *last, uint32_
     Hacl_Hash_Blake2b_Simd256_update_last(last_len,
       wv,
       p1,
+      false,
       FStar_UInt128_uint64_to_uint128(prev_len),
       last_len,
       last);
diff --git a/src/Hacl_Bignum.c b/src/Hacl_Bignum.c
index 568bcc26..7f3710b3 100644
--- a/src/Hacl_Bignum.c
+++ b/src/Hacl_Bignum.c
@@ -832,7 +832,7 @@ uint32_t Hacl_Bignum_Montgomery_bn_check_modulus_u32(uint32_t len, uint32_t *n)
   {
     uint32_t beq = FStar_UInt32_eq_mask(one[i], n[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(one[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U)));
+    acc = (beq & acc) | (~beq & blt);
   }
   uint32_t m1 = acc;
   return m0 & m1;
@@ -1023,7 +1023,7 @@ uint64_t Hacl_Bignum_Montgomery_bn_check_modulus_u64(uint32_t len, uint64_t *n)
   {
     uint64_t beq = FStar_UInt64_eq_mask(one[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(one[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+    acc = (beq & acc) | (~beq & blt);
   }
   uint64_t m1 = acc;
   return m0 & m1;
@@ -1415,7 +1415,7 @@ Hacl_Bignum_Exponentiation_bn_check_mod_exp_u32(
   {
     uint32_t beq = FStar_UInt32_eq_mask(one[i], n[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(one[i], n[i]);
-    acc0 = (beq & acc0) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U)));
+    acc0 = (beq & acc0) | (~beq & blt);
   }
   uint32_t m10 = acc0;
   uint32_t m00 = m0 & m10;
@@ -1442,7 +1442,7 @@ Hacl_Bignum_Exponentiation_bn_check_mod_exp_u32(
     {
       uint32_t beq = FStar_UInt32_eq_mask(b[i], b2[i]);
       uint32_t blt = ~FStar_UInt32_gte_mask(b[i], b2[i]);
-      acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U)));
+      acc = (beq & acc) | (~beq & blt);
     }
     uint32_t res = acc;
     m1 = res;
@@ -1456,7 +1456,7 @@ Hacl_Bignum_Exponentiation_bn_check_mod_exp_u32(
   {
     uint32_t beq = FStar_UInt32_eq_mask(a[i], n[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(a[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U)));
+    acc = (beq & acc) | (~beq & blt);
   }
   uint32_t m2 = acc;
   uint32_t m = m1 & m2;
@@ -1809,7 +1809,7 @@ Hacl_Bignum_Exponentiation_bn_check_mod_exp_u64(
   {
     uint64_t beq = FStar_UInt64_eq_mask(one[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(one[i], n[i]);
-    acc0 = (beq & acc0) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+    acc0 = (beq & acc0) | (~beq & blt);
   }
   uint64_t m10 = acc0;
   uint64_t m00 = m0 & m10;
@@ -1836,7 +1836,7 @@ Hacl_Bignum_Exponentiation_bn_check_mod_exp_u64(
     {
       uint64_t beq = FStar_UInt64_eq_mask(b[i], b2[i]);
       uint64_t blt = ~FStar_UInt64_gte_mask(b[i], b2[i]);
-      acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+      acc = (beq & acc) | (~beq & blt);
     }
     uint64_t res = acc;
     m1 = res;
@@ -1850,7 +1850,7 @@ Hacl_Bignum_Exponentiation_bn_check_mod_exp_u64(
   {
     uint64_t beq = FStar_UInt64_eq_mask(a[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(a[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+    acc = (beq & acc) | (~beq & blt);
   }
   uint64_t m2 = acc;
   uint64_t m = m1 & m2;
diff --git a/src/Hacl_Bignum256.c b/src/Hacl_Bignum256.c
index 54bbc88a..45c4252e 100644
--- a/src/Hacl_Bignum256.c
+++ b/src/Hacl_Bignum256.c
@@ -512,7 +512,7 @@ bool Hacl_Bignum256_mod(uint64_t *n, uint64_t *a, uint64_t *res)
     1U,
     uint64_t beq = FStar_UInt64_eq_mask(one[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(one[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL))););
+    acc = (beq & acc) | (~beq & blt););
   uint64_t m1 = acc;
   uint64_t is_valid_m = m0 & m1;
   uint32_t nBits = 64U * (uint32_t)Hacl_Bignum_Lib_bn_get_top_index_u64(4U, n);
@@ -544,7 +544,7 @@ static uint64_t exp_check(uint64_t *n, uint64_t *a, uint32_t bBits, uint64_t *b)
     1U,
     uint64_t beq = FStar_UInt64_eq_mask(one[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(one[i], n[i]);
-    acc0 = (beq & acc0) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL))););
+    acc0 = (beq & acc0) | (~beq & blt););
   uint64_t m10 = acc0;
   uint64_t m00 = m0 & m10;
   uint32_t bLen;
@@ -570,7 +570,7 @@ static uint64_t exp_check(uint64_t *n, uint64_t *a, uint32_t bBits, uint64_t *b)
     {
       uint64_t beq = FStar_UInt64_eq_mask(b[i], b2[i]);
       uint64_t blt = ~FStar_UInt64_gte_mask(b[i], b2[i]);
-      acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+      acc = (beq & acc) | (~beq & blt);
     }
     uint64_t res = acc;
     m1 = res;
@@ -586,7 +586,7 @@ static uint64_t exp_check(uint64_t *n, uint64_t *a, uint32_t bBits, uint64_t *b)
     1U,
     uint64_t beq = FStar_UInt64_eq_mask(a[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(a[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL))););
+    acc = (beq & acc) | (~beq & blt););
   uint64_t m2 = acc;
   uint64_t m = m1 & m2;
   return m00 & m;
@@ -990,7 +990,7 @@ bool Hacl_Bignum256_mod_inv_prime_vartime(uint64_t *n, uint64_t *a, uint64_t *re
     1U,
     uint64_t beq = FStar_UInt64_eq_mask(one[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(one[i], n[i]);
-    acc0 = (beq & acc0) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL))););
+    acc0 = (beq & acc0) | (~beq & blt););
   uint64_t m1 = acc0;
   uint64_t m00 = m0 & m1;
   uint64_t bn_zero[4U] = { 0U };
@@ -1011,7 +1011,7 @@ bool Hacl_Bignum256_mod_inv_prime_vartime(uint64_t *n, uint64_t *a, uint64_t *re
     1U,
     uint64_t beq = FStar_UInt64_eq_mask(a[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(a[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL))););
+    acc = (beq & acc) | (~beq & blt););
   uint64_t m2 = acc;
   uint64_t is_valid_m = (m00 & ~m10) & m2;
   uint32_t nBits = 64U * (uint32_t)Hacl_Bignum_Lib_bn_get_top_index_u64(4U, n);
@@ -1351,7 +1351,7 @@ uint64_t Hacl_Bignum256_lt_mask(uint64_t *a, uint64_t *b)
     1U,
     uint64_t beq = FStar_UInt64_eq_mask(a[i], b[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(a[i], b[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL))););
+    acc = (beq & acc) | (~beq & blt););
   return acc;
 }
 
diff --git a/src/Hacl_Bignum256_32.c b/src/Hacl_Bignum256_32.c
index eed6c65c..e198a5f1 100644
--- a/src/Hacl_Bignum256_32.c
+++ b/src/Hacl_Bignum256_32.c
@@ -532,7 +532,7 @@ bool Hacl_Bignum256_32_mod(uint32_t *n, uint32_t *a, uint32_t *res)
     1U,
     uint32_t beq = FStar_UInt32_eq_mask(one[i], n[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(one[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U))););
+    acc = (beq & acc) | (~beq & blt););
   uint32_t m1 = acc;
   uint32_t is_valid_m = m0 & m1;
   uint32_t nBits = 32U * Hacl_Bignum_Lib_bn_get_top_index_u32(8U, n);
@@ -564,7 +564,7 @@ static uint32_t exp_check(uint32_t *n, uint32_t *a, uint32_t bBits, uint32_t *b)
     1U,
     uint32_t beq = FStar_UInt32_eq_mask(one[i], n[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(one[i], n[i]);
-    acc0 = (beq & acc0) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U))););
+    acc0 = (beq & acc0) | (~beq & blt););
   uint32_t m10 = acc0;
   uint32_t m00 = m0 & m10;
   uint32_t bLen;
@@ -590,7 +590,7 @@ static uint32_t exp_check(uint32_t *n, uint32_t *a, uint32_t bBits, uint32_t *b)
     {
       uint32_t beq = FStar_UInt32_eq_mask(b[i], b2[i]);
       uint32_t blt = ~FStar_UInt32_gte_mask(b[i], b2[i]);
-      acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U)));
+      acc = (beq & acc) | (~beq & blt);
     }
     uint32_t res = acc;
     m1 = res;
@@ -606,7 +606,7 @@ static uint32_t exp_check(uint32_t *n, uint32_t *a, uint32_t bBits, uint32_t *b)
     1U,
     uint32_t beq = FStar_UInt32_eq_mask(a[i], n[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(a[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U))););
+    acc = (beq & acc) | (~beq & blt););
   uint32_t m2 = acc;
   uint32_t m = m1 & m2;
   return m00 & m;
@@ -1010,7 +1010,7 @@ bool Hacl_Bignum256_32_mod_inv_prime_vartime(uint32_t *n, uint32_t *a, uint32_t
     1U,
     uint32_t beq = FStar_UInt32_eq_mask(one[i], n[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(one[i], n[i]);
-    acc0 = (beq & acc0) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U))););
+    acc0 = (beq & acc0) | (~beq & blt););
   uint32_t m1 = acc0;
   uint32_t m00 = m0 & m1;
   uint32_t bn_zero[8U] = { 0U };
@@ -1031,7 +1031,7 @@ bool Hacl_Bignum256_32_mod_inv_prime_vartime(uint32_t *n, uint32_t *a, uint32_t
     1U,
     uint32_t beq = FStar_UInt32_eq_mask(a[i], n[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(a[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U))););
+    acc = (beq & acc) | (~beq & blt););
   uint32_t m2 = acc;
   uint32_t is_valid_m = (m00 & ~m10) & m2;
   uint32_t nBits = 32U * Hacl_Bignum_Lib_bn_get_top_index_u32(8U, n);
@@ -1399,7 +1399,7 @@ uint32_t Hacl_Bignum256_32_lt_mask(uint32_t *a, uint32_t *b)
     1U,
     uint32_t beq = FStar_UInt32_eq_mask(a[i], b[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(a[i], b[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U))););
+    acc = (beq & acc) | (~beq & blt););
   return acc;
 }
 
diff --git a/src/Hacl_Bignum32.c b/src/Hacl_Bignum32.c
index 34b46324..86bfac2a 100644
--- a/src/Hacl_Bignum32.c
+++ b/src/Hacl_Bignum32.c
@@ -46,9 +46,18 @@ of `len` unsigned 32-bit integers, i.e. uint32_t[len].
 /**
 Write `a + b mod 2 ^ (32 * len)` in `res`.
 
-  This functions returns the carry.
-
-  The arguments a, b and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len]
+  This function returns the carry.
+  
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `b` or `res`. May have exactly equal memory
+    location to `b` or `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `a` or `res`. May have exactly
+    equal memory location to `a` or `res`.
+  @param[out] res Points to `len` number of limbs where the carry is written, i.e. `uint32_t[len]`.
+    Must not partially overlap the memory locations of `a` or `b`. May have
+    exactly equal memory location to `a` or `b`.
 */
 uint32_t Hacl_Bignum32_add(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res)
 {
@@ -60,7 +69,16 @@ Write `a - b mod 2 ^ (32 * len)` in `res`.
 
   This functions returns the carry.
 
-  The arguments a, b and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len]
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `b` or `res`. May have exactly
+    equal memory location to `b` or `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `a` or `res`. May have exactly
+    equal memory location to `a` or `res`.
+  @param[out] res Points to `len` number of limbs where the carry is written, i.e. `uint32_t[len]`.
+    Must not partially overlap the memory locations of `a` or `b`. May have
+    exactly equal memory location to `a` or `b`.
 */
 uint32_t Hacl_Bignum32_sub(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res)
 {
@@ -70,12 +88,23 @@ uint32_t Hacl_Bignum32_sub(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res
 /**
 Write `(a + b) mod n` in `res`.
 
-  The arguments a, b, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • a < n
-  • b < n
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `b` or `res`. May have exactly
+    equal memory location to `b` or `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `a` or `res`. May have exactly
+    equal memory location to `a` or `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a`, `b`, and `res`.
+  @param[out] res Points to `len` number of limbs where the result is written, i.e. `uint32_t[len]`.
+    Must not partially overlap the memory locations of `a` or `b`. May have
+    exactly equal memory location to `a` or `b`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `a < n`
+    - `b < n`
 */
 void Hacl_Bignum32_add_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *b, uint32_t *res)
 {
@@ -85,12 +114,23 @@ void Hacl_Bignum32_add_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *b,
 /**
 Write `(a - b) mod n` in `res`.
 
-  The arguments a, b, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • a < n
-  • b < n
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `b` or `res`. May have exactly
+    equal memory location to `b` or `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `a` or `res`. May have exactly
+    equal memory location to `a` or `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a`, `b`, and `res`.
+  @param[out] res Points to `len` number of limbs where the result is written, i.e. `uint32_t[len]`.
+    Must not partially overlap the memory locations of `a` or `b`. May have
+    exactly equal memory location to `a` or `b`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `a < n`
+    - `b < n`
 */
 void Hacl_Bignum32_sub_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *b, uint32_t *res)
 {
@@ -100,8 +140,13 @@ void Hacl_Bignum32_sub_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *b,
 /**
 Write `a * b` in `res`.
 
-  The arguments a and b are meant to be `len` limbs in size, i.e. uint32_t[len].
-  The outparam res is meant to be `2*len` limbs in size, i.e. uint32_t[2*len].
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `b` and `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `a` and `res`.
+  @param[out] res Points to `2*len` number of limbs where the result is written, i.e. `uint32_t[2*len]`.
+    Must be disjoint from the memory locations of `a` and `b`.
 */
 void Hacl_Bignum32_mul(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res)
 {
@@ -114,8 +159,10 @@ void Hacl_Bignum32_mul(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res)
 /**
 Write `a * a` in `res`.
 
-  The argument a is meant to be `len` limbs in size, i.e. uint32_t[len].
-  The outparam res is meant to be `2*len` limbs in size, i.e. uint32_t[2*len].
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[out] res Points to `2*len` number of limbs where the result is written, i.e. `uint32_t[2*len]`.
+    Must be disjoint from the memory location of `a`.
 */
 void Hacl_Bignum32_sqr(uint32_t len, uint32_t *a, uint32_t *res)
 {
@@ -149,13 +196,19 @@ bn_slow_precomp(
 /**
 Write `a mod n` in `res`.
 
-  The argument a is meant to be `2*len` limbs in size, i.e. uint32_t[2*len].
-  The argument n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  The function returns false if any of the following preconditions are violated,
-  true otherwise.
-   • 1 < n
-   • n % 2 = 1 
+  @param[in] a Points to `2*len` number of limbs, i.e. `uint32_t[2*len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `n`.
+  
+  @return `false` if any precondition is violated, `true` otherwise.
+  
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `1 < n`
+    - `n % 2 = 1`
 */
 bool Hacl_Bignum32_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *res)
 {
@@ -171,7 +224,7 @@ bool Hacl_Bignum32_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *res)
   {
     uint32_t beq = FStar_UInt32_eq_mask(one[i], n[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(one[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U)));
+    acc = (beq & acc) | (~beq & blt);
   }
   uint32_t m1 = acc;
   uint32_t is_valid_m = m0 & m1;
@@ -195,22 +248,30 @@ bool Hacl_Bignum32_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *res)
 /**
 Write `a ^ b mod n` in `res`.
 
-  The arguments a, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  The argument b is a bignum of any size, and bBits is an upper bound on the
-  number of significant bits of b. A tighter bound results in faster execution
-  time. When in doubt, the number of bits for the bignum size is always a safe
-  default, e.g. if b is a 4096-bit bignum, bBits should be 4096.
-
-  The function is *NOT* constant-time on the argument b. See the
-  mod_exp_consttime_* functions for constant-time variants.
-
-  The function returns false if any of the following preconditions are violated,
-  true otherwise.
-   • n % 2 = 1
-   • 1 < n
-   • b < pow2 bBits
-   • a < n
+  This function is *NOT* constant-time on the argument `b`. See the
+  `mod_exp_consttime_*` functions for constant-time variants.
+
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `n` and `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `res`.
+  @param[in] b Points to a bignum of any size, with an upper bound of `bBits` number of
+    significant bits. Must be disjoint from the memory location of `res`.
+  @param[in] bBits An upper bound on the number of significant bits of `b`.
+    A tighter bound results in faster execution time. When in doubt, the number
+    of bits for the bignum size is always a safe default, e.g. if `b` is a 4096-bit
+    bignum, `bBits` should be `4096`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a`, `b`, and `n`.
+    
+  @return `false` if any preconditions are violated, `true` otherwise.
+  
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n % 2 = 1`
+    - `1 < n`
+    - `b < pow2 bBits`
+    - `a < n`
 */
 bool
 Hacl_Bignum32_mod_exp_vartime(
@@ -238,22 +299,30 @@ Hacl_Bignum32_mod_exp_vartime(
 /**
 Write `a ^ b mod n` in `res`.
 
-  The arguments a, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  The argument b is a bignum of any size, and bBits is an upper bound on the
-  number of significant bits of b. A tighter bound results in faster execution
-  time. When in doubt, the number of bits for the bignum size is always a safe
-  default, e.g. if b is a 4096-bit bignum, bBits should be 4096.
-
-  This function is constant-time over its argument b, at the cost of a slower
-  execution time than mod_exp_vartime.
-
-  The function returns false if any of the following preconditions are violated,
-  true otherwise.
-   • n % 2 = 1
-   • 1 < n
-   • b < pow2 bBits
-   • a < n
+  This function is constant-time over its argument `b`, at the cost of a slower
+  execution time than `mod_exp_vartime_*`.
+  
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `n` and `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `res`.
+  @param[in] b Points to a bignum of any size, with an upper bound of `bBits` number of
+    significant bits. Must be disjoint from the memory location of `res`.
+  @param[in] bBits An upper bound on the number of significant bits of `b`.
+    A tighter bound results in faster execution time. When in doubt, the number
+    of bits for the bignum size is always a safe default, e.g. if `b` is a 4096-bit
+    bignum, `bBits` should be `4096`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a`, `b`, and `n`.
+    
+  @return `false` if any preconditions are violated, `true` otherwise.
+
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n % 2 = 1`
+    - `1 < n`
+    - `b < pow2 bBits`
+    - `a < n`
 */
 bool
 Hacl_Bignum32_mod_exp_consttime(
@@ -281,18 +350,23 @@ Hacl_Bignum32_mod_exp_consttime(
 /**
 Write `a ^ (-1) mod n` in `res`.
 
-  The arguments a, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • n is a prime
-
-  The function returns false if any of the following preconditions are violated,
-  true otherwise.
-  • n % 2 = 1
-  • 1 < n
-  • 0 < a
-  • a < n
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `n` and `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `res`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `a` and `n`.
+    
+  @return `false` if any preconditions (except the precondition: `n` is a prime)
+    are violated, `true` otherwise.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n` is a prime
+    - `n % 2 = 1`
+    - `1 < n`
+    - `0 < a`
+    - `a < n`
 */
 bool Hacl_Bignum32_mod_inv_prime_vartime(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *res)
 {
@@ -308,7 +382,7 @@ bool Hacl_Bignum32_mod_inv_prime_vartime(uint32_t len, uint32_t *n, uint32_t *a,
   {
     uint32_t beq = FStar_UInt32_eq_mask(one[i], n[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(one[i], n[i]);
-    acc0 = (beq & acc0) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U)));
+    acc0 = (beq & acc0) | (~beq & blt);
   }
   uint32_t m1 = acc0;
   uint32_t m00 = m0 & m1;
@@ -329,7 +403,7 @@ bool Hacl_Bignum32_mod_inv_prime_vartime(uint32_t len, uint32_t *n, uint32_t *a,
   {
     uint32_t beq = FStar_UInt32_eq_mask(a[i], n[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(a[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U)));
+    acc = (beq & acc) | (~beq & blt);
   }
   uint32_t m2 = acc;
   uint32_t is_valid_m = (m00 & ~m10) & m2;
@@ -393,15 +467,16 @@ bool Hacl_Bignum32_mod_inv_prime_vartime(uint32_t len, uint32_t *n, uint32_t *a,
 /**
 Heap-allocate and initialize a montgomery context.
 
-  The argument n is meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • n % 2 = 1
-  • 1 < n
+  @param n Points to `len` number of limbs, i.e. `uint32_t[len]`.
 
-  The caller will need to call Hacl_Bignum32_mont_ctx_free on the return value
-  to avoid memory leaks.
+  @return A pointer to an allocated and initialized Montgomery context is returned.
+    Clients will need to call `Hacl_Bignum32_mont_ctx_free` on the return value to
+    avoid memory leaks.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n % 2 = 1`
+    - `1 < n`
 */
 Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32
 *Hacl_Bignum32_mont_ctx_init(uint32_t len, uint32_t *n)
@@ -429,7 +504,7 @@ Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32
 /**
 Deallocate the memory previously allocated by Hacl_Bignum32_mont_ctx_init.
 
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
+  @param k Points to a Montgomery context obtained through `Hacl_Bignum32_mont_ctx_init`.
 */
 void Hacl_Bignum32_mont_ctx_free(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k)
 {
@@ -444,9 +519,11 @@ void Hacl_Bignum32_mont_ctx_free(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k)
 /**
 Write `a mod n` in `res`.
 
-  The argument a is meant to be `2*len` limbs in size, i.e. uint32_t[2*len].
-  The outparam res is meant to be `len` limbs in size, i.e. uint32_t[len].
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
+  @param[in] k Points to a Montgomery context obtained from `Hacl_Bignum32_mont_ctx_init`.
+  @param[in] a Points to `2*len` number of limbs, i.e. `uint32_t[2*len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `a`.
 */
 void
 Hacl_Bignum32_mod_precomp(
@@ -464,21 +541,25 @@ Hacl_Bignum32_mod_precomp(
 /**
 Write `a ^ b mod n` in `res`.
 
-  The arguments a and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
-
-  The argument b is a bignum of any size, and bBits is an upper bound on the
-  number of significant bits of b. A tighter bound results in faster execution
-  time. When in doubt, the number of bits for the bignum size is always a safe
-  default, e.g. if b is a 4096-bit bignum, bBits should be 4096.
-
-  The function is *NOT* constant-time on the argument b. See the
-  mod_exp_consttime_* functions for constant-time variants.
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • b < pow2 bBits
-  • a < n
+  This function is *NOT* constant-time on the argument `b`. See the
+  `mod_exp_consttime_*` functions for constant-time variants.
+
+  @param[in] k Points to a Montgomery context obtained from `Hacl_Bignum32_mont_ctx_init`.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[in] b Points to a bignum of any size, with an upper bound of `bBits` number of
+    significant bits. Must be disjoint from the memory location of `res`.
+  @param[in] bBits An upper bound on the number of significant bits of `b`.
+    A tighter bound results in faster execution time. When in doubt, the number
+    of bits for the bignum size is always a safe default, e.g. if `b` is a 4096-bit
+    bignum, `bBits` should be `4096`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `b`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `b < pow2 bBits`
+    - `a < n`
 */
 void
 Hacl_Bignum32_mod_exp_vartime_precomp(
@@ -505,21 +586,25 @@ Hacl_Bignum32_mod_exp_vartime_precomp(
 /**
 Write `a ^ b mod n` in `res`.
 
-  The arguments a and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
-
-  The argument b is a bignum of any size, and bBits is an upper bound on the
-  number of significant bits of b. A tighter bound results in faster execution
-  time. When in doubt, the number of bits for the bignum size is always a safe
-  default, e.g. if b is a 4096-bit bignum, bBits should be 4096.
-
   This function is constant-time over its argument b, at the cost of a slower
-  execution time than mod_exp_vartime_*.
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • b < pow2 bBits
-  • a < n
+  execution time than `mod_exp_vartime_*`.
+
+  @param[in] k Points to a Montgomery context obtained from `Hacl_Bignum32_mont_ctx_init`.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[in] b Points to a bignum of any size, with an upper bound of `bBits` number of
+    significant bits. Must be disjoint from the memory location of `res`.
+  @param[in] bBits An upper bound on the number of significant bits of `b`.
+    A tighter bound results in faster execution time. When in doubt, the number
+    of bits for the bignum size is always a safe default, e.g. if `b` is a 4096-bit
+    bignum, `bBits` should be `4096`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `b`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `b < pow2 bBits`
+    - `a < n`
 */
 void
 Hacl_Bignum32_mod_exp_consttime_precomp(
@@ -546,14 +631,17 @@ Hacl_Bignum32_mod_exp_consttime_precomp(
 /**
 Write `a ^ (-1) mod n` in `res`.
 
-  The argument a and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • n is a prime
-  • 0 < a
-  • a < n
+  @param[in] k Points to a Montgomery context obtained through `Hacl_Bignum32_mont_ctx_init`.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `a`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n` is a prime
+    - `0 < a`
+    - `a < n`
 */
 void
 Hacl_Bignum32_mod_inv_prime_vartime_precomp(
@@ -623,13 +711,13 @@ Hacl_Bignum32_mod_inv_prime_vartime_precomp(
 /**
 Load a bid-endian bignum from memory.
 
-  The argument b points to `len` bytes of valid memory.
-  The function returns a heap-allocated bignum of size sufficient to hold the
-   result of loading b, or NULL if either the allocation failed, or the amount of
-    required memory would exceed 4GB.
-
-  If the return value is non-null, clients must eventually call free(3) on it to
-  avoid memory leaks.
+  @param len Size of `b` as number of bytes.
+  @param b Points to `len` number of bytes, i.e. `uint8_t[len]`.
+  
+  @return A heap-allocated bignum of size sufficient to hold the result of
+    loading `b`. Otherwise, `NULL`, if either the allocation failed, or the amount
+    of required memory would exceed 4GB. Clients must `free(3)` any non-null return
+    value to avoid memory leaks.
 */
 uint32_t *Hacl_Bignum32_new_bn_from_bytes_be(uint32_t len, uint8_t *b)
 {
@@ -664,13 +752,13 @@ uint32_t *Hacl_Bignum32_new_bn_from_bytes_be(uint32_t len, uint8_t *b)
 /**
 Load a little-endian bignum from memory.
 
-  The argument b points to `len` bytes of valid memory.
-  The function returns a heap-allocated bignum of size sufficient to hold the
-   result of loading b, or NULL if either the allocation failed, or the amount of
-    required memory would exceed 4GB.
-
-  If the return value is non-null, clients must eventually call free(3) on it to
-  avoid memory leaks.
+  @param len Size of `b` as number of bytes.
+  @param b Points to `len` number of bytes, i.e. `uint8_t[len]`.
+  
+  @return A heap-allocated bignum of size sufficient to hold the result of
+    loading `b`. Otherwise, `NULL`, if either the allocation failed, or the amount
+    of required memory would exceed 4GB. Clients must `free(3)` any non-null return
+    value to avoid memory leaks.
 */
 uint32_t *Hacl_Bignum32_new_bn_from_bytes_le(uint32_t len, uint8_t *b)
 {
@@ -707,8 +795,11 @@ uint32_t *Hacl_Bignum32_new_bn_from_bytes_le(uint32_t len, uint8_t *b)
 /**
 Serialize a bignum into big-endian memory.
 
-  The argument b points to a bignum of ⌈len / 4⌉ size.
-  The outparam res points to `len` bytes of valid memory.
+  @param[in] len Size of `b` as number of bytes.
+  @param[in] b Points to a bignum of `ceil(len/4)` size. Must be disjoint from
+    the memory location of `res`.
+  @param[out] res Points to `len` number of bytes, i.e. `uint8_t[len]`. Must be
+    disjoint from the memory location of `b`.
 */
 void Hacl_Bignum32_bn_to_bytes_be(uint32_t len, uint32_t *b, uint8_t *res)
 {
@@ -727,8 +818,11 @@ void Hacl_Bignum32_bn_to_bytes_be(uint32_t len, uint32_t *b, uint8_t *res)
 /**
 Serialize a bignum into little-endian memory.
 
-  The argument b points to a bignum of ⌈len / 4⌉ size.
-  The outparam res points to `len` bytes of valid memory.
+  @param[in] len Size of `b` as number of bytes.
+  @param[in] b Points to a bignum of `ceil(len/4)` size. Must be disjoint from
+    the memory location of `res`.
+  @param[out] res Points to `len` number of bytes, i.e. `uint8_t[len]`. Must be
+    disjoint from the memory location of `b`.
 */
 void Hacl_Bignum32_bn_to_bytes_le(uint32_t len, uint32_t *b, uint8_t *res)
 {
@@ -753,7 +847,11 @@ void Hacl_Bignum32_bn_to_bytes_le(uint32_t len, uint32_t *b, uint8_t *res)
 /**
 Returns 2^32 - 1 if a < b, otherwise returns 0.
 
- The arguments a and b are meant to be `len` limbs in size, i.e. uint32_t[len].
+  @param len Number of limbs.
+  @param a Points to `len` number of limbs, i.e. `uint32_t[len]`.
+  @param b Points to `len` number of limbs, i.e. `uint32_t[len]`.
+  
+  @return `2^32 - 1` if `a < b`, otherwise, `0`.
 */
 uint32_t Hacl_Bignum32_lt_mask(uint32_t len, uint32_t *a, uint32_t *b)
 {
@@ -762,7 +860,7 @@ uint32_t Hacl_Bignum32_lt_mask(uint32_t len, uint32_t *a, uint32_t *b)
   {
     uint32_t beq = FStar_UInt32_eq_mask(a[i], b[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(a[i], b[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U)));
+    acc = (beq & acc) | (~beq & blt);
   }
   return acc;
 }
@@ -770,7 +868,11 @@ uint32_t Hacl_Bignum32_lt_mask(uint32_t len, uint32_t *a, uint32_t *b)
 /**
 Returns 2^32 - 1 if a = b, otherwise returns 0.
 
- The arguments a and b are meant to be `len` limbs in size, i.e. uint32_t[len].
+  @param len Number of limbs.
+  @param a Points to `len` number of limbs, i.e. `uint32_t[len]`.
+  @param b Points to `len` number of limbs, i.e. `uint32_t[len]`.
+  
+  @return `2^32 - 1` if a = b, otherwise, `0`.
 */
 uint32_t Hacl_Bignum32_eq_mask(uint32_t len, uint32_t *a, uint32_t *b)
 {
diff --git a/src/Hacl_Bignum4096.c b/src/Hacl_Bignum4096.c
index 3572db07..8f078581 100644
--- a/src/Hacl_Bignum4096.c
+++ b/src/Hacl_Bignum4096.c
@@ -459,7 +459,7 @@ bool Hacl_Bignum4096_mod(uint64_t *n, uint64_t *a, uint64_t *res)
   {
     uint64_t beq = FStar_UInt64_eq_mask(one[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(one[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+    acc = (beq & acc) | (~beq & blt);
   }
   uint64_t m1 = acc;
   uint64_t is_valid_m = m0 & m1;
@@ -490,7 +490,7 @@ static uint64_t exp_check(uint64_t *n, uint64_t *a, uint32_t bBits, uint64_t *b)
   {
     uint64_t beq = FStar_UInt64_eq_mask(one[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(one[i], n[i]);
-    acc0 = (beq & acc0) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+    acc0 = (beq & acc0) | (~beq & blt);
   }
   uint64_t m10 = acc0;
   uint64_t m00 = m0 & m10;
@@ -517,7 +517,7 @@ static uint64_t exp_check(uint64_t *n, uint64_t *a, uint32_t bBits, uint64_t *b)
     {
       uint64_t beq = FStar_UInt64_eq_mask(b[i], b2[i]);
       uint64_t blt = ~FStar_UInt64_gte_mask(b[i], b2[i]);
-      acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+      acc = (beq & acc) | (~beq & blt);
     }
     uint64_t res = acc;
     m1 = res;
@@ -531,7 +531,7 @@ static uint64_t exp_check(uint64_t *n, uint64_t *a, uint32_t bBits, uint64_t *b)
   {
     uint64_t beq = FStar_UInt64_eq_mask(a[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(a[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+    acc = (beq & acc) | (~beq & blt);
   }
   uint64_t m2 = acc;
   uint64_t m = m1 & m2;
@@ -930,7 +930,7 @@ bool Hacl_Bignum4096_mod_inv_prime_vartime(uint64_t *n, uint64_t *a, uint64_t *r
   {
     uint64_t beq = FStar_UInt64_eq_mask(one[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(one[i], n[i]);
-    acc0 = (beq & acc0) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+    acc0 = (beq & acc0) | (~beq & blt);
   }
   uint64_t m1 = acc0;
   uint64_t m00 = m0 & m1;
@@ -949,7 +949,7 @@ bool Hacl_Bignum4096_mod_inv_prime_vartime(uint64_t *n, uint64_t *a, uint64_t *r
   {
     uint64_t beq = FStar_UInt64_eq_mask(a[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(a[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+    acc = (beq & acc) | (~beq & blt);
   }
   uint64_t m2 = acc;
   uint64_t is_valid_m = (m00 & ~m10) & m2;
@@ -1326,7 +1326,7 @@ uint64_t Hacl_Bignum4096_lt_mask(uint64_t *a, uint64_t *b)
   {
     uint64_t beq = FStar_UInt64_eq_mask(a[i], b[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(a[i], b[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+    acc = (beq & acc) | (~beq & blt);
   }
   return acc;
 }
diff --git a/src/Hacl_Bignum4096_32.c b/src/Hacl_Bignum4096_32.c
index 1a8b361c..8d03caff 100644
--- a/src/Hacl_Bignum4096_32.c
+++ b/src/Hacl_Bignum4096_32.c
@@ -451,7 +451,7 @@ bool Hacl_Bignum4096_32_mod(uint32_t *n, uint32_t *a, uint32_t *res)
   {
     uint32_t beq = FStar_UInt32_eq_mask(one[i], n[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(one[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U)));
+    acc = (beq & acc) | (~beq & blt);
   }
   uint32_t m1 = acc;
   uint32_t is_valid_m = m0 & m1;
@@ -482,7 +482,7 @@ static uint32_t exp_check(uint32_t *n, uint32_t *a, uint32_t bBits, uint32_t *b)
   {
     uint32_t beq = FStar_UInt32_eq_mask(one[i], n[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(one[i], n[i]);
-    acc0 = (beq & acc0) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U)));
+    acc0 = (beq & acc0) | (~beq & blt);
   }
   uint32_t m10 = acc0;
   uint32_t m00 = m0 & m10;
@@ -509,7 +509,7 @@ static uint32_t exp_check(uint32_t *n, uint32_t *a, uint32_t bBits, uint32_t *b)
     {
       uint32_t beq = FStar_UInt32_eq_mask(b[i], b2[i]);
       uint32_t blt = ~FStar_UInt32_gte_mask(b[i], b2[i]);
-      acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U)));
+      acc = (beq & acc) | (~beq & blt);
     }
     uint32_t res = acc;
     m1 = res;
@@ -523,7 +523,7 @@ static uint32_t exp_check(uint32_t *n, uint32_t *a, uint32_t bBits, uint32_t *b)
   {
     uint32_t beq = FStar_UInt32_eq_mask(a[i], n[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(a[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U)));
+    acc = (beq & acc) | (~beq & blt);
   }
   uint32_t m2 = acc;
   uint32_t m = m1 & m2;
@@ -922,7 +922,7 @@ bool Hacl_Bignum4096_32_mod_inv_prime_vartime(uint32_t *n, uint32_t *a, uint32_t
   {
     uint32_t beq = FStar_UInt32_eq_mask(one[i], n[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(one[i], n[i]);
-    acc0 = (beq & acc0) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U)));
+    acc0 = (beq & acc0) | (~beq & blt);
   }
   uint32_t m1 = acc0;
   uint32_t m00 = m0 & m1;
@@ -941,7 +941,7 @@ bool Hacl_Bignum4096_32_mod_inv_prime_vartime(uint32_t *n, uint32_t *a, uint32_t
   {
     uint32_t beq = FStar_UInt32_eq_mask(a[i], n[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(a[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U)));
+    acc = (beq & acc) | (~beq & blt);
   }
   uint32_t m2 = acc;
   uint32_t is_valid_m = (m00 & ~m10) & m2;
@@ -1317,7 +1317,7 @@ uint32_t Hacl_Bignum4096_32_lt_mask(uint32_t *a, uint32_t *b)
   {
     uint32_t beq = FStar_UInt32_eq_mask(a[i], b[i]);
     uint32_t blt = ~FStar_UInt32_gte_mask(a[i], b[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFU) | (~blt & 0U)));
+    acc = (beq & acc) | (~beq & blt);
   }
   return acc;
 }
diff --git a/src/Hacl_Bignum64.c b/src/Hacl_Bignum64.c
index f8f5bb6f..a4ac64c2 100644
--- a/src/Hacl_Bignum64.c
+++ b/src/Hacl_Bignum64.c
@@ -170,7 +170,7 @@ bool Hacl_Bignum64_mod(uint32_t len, uint64_t *n, uint64_t *a, uint64_t *res)
   {
     uint64_t beq = FStar_UInt64_eq_mask(one[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(one[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+    acc = (beq & acc) | (~beq & blt);
   }
   uint64_t m1 = acc;
   uint64_t is_valid_m = m0 & m1;
@@ -307,7 +307,7 @@ bool Hacl_Bignum64_mod_inv_prime_vartime(uint32_t len, uint64_t *n, uint64_t *a,
   {
     uint64_t beq = FStar_UInt64_eq_mask(one[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(one[i], n[i]);
-    acc0 = (beq & acc0) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+    acc0 = (beq & acc0) | (~beq & blt);
   }
   uint64_t m1 = acc0;
   uint64_t m00 = m0 & m1;
@@ -328,7 +328,7 @@ bool Hacl_Bignum64_mod_inv_prime_vartime(uint32_t len, uint64_t *n, uint64_t *a,
   {
     uint64_t beq = FStar_UInt64_eq_mask(a[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(a[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+    acc = (beq & acc) | (~beq & blt);
   }
   uint64_t m2 = acc;
   uint64_t is_valid_m = (m00 & ~m10) & m2;
@@ -761,7 +761,7 @@ uint64_t Hacl_Bignum64_lt_mask(uint32_t len, uint64_t *a, uint64_t *b)
   {
     uint64_t beq = FStar_UInt64_eq_mask(a[i], b[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(a[i], b[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+    acc = (beq & acc) | (~beq & blt);
   }
   return acc;
 }
diff --git a/src/Hacl_Ed25519.c b/src/Hacl_Ed25519.c
index d1f8edf2..61e379d2 100644
--- a/src/Hacl_Ed25519.c
+++ b/src/Hacl_Ed25519.c
@@ -509,11 +509,7 @@ static inline bool recover_x(uint64_t *x, uint64_t *y, uint64_t sign)
       Hacl_Bignum25519_reduce_513(t01);
       reduce(t01);
       bool z1 = is_0(t01);
-      if (z1 == false)
-      {
-        res = false;
-      }
-      else
+      if (z1)
       {
         uint64_t *x32 = tmp + 5U;
         uint64_t *t0 = tmp + 10U;
@@ -534,6 +530,10 @@ static inline bool recover_x(uint64_t *x, uint64_t *y, uint64_t sign)
         memcpy(x, x32, 5U * sizeof (uint64_t));
         res = true;
       }
+      else
+      {
+        res = false;
+      }
     }
   }
   bool res0 = res;
@@ -551,11 +551,7 @@ bool Hacl_Impl_Ed25519_PointDecompress_point_decompress(uint64_t *out, uint8_t *
   Hacl_Bignum25519_load_51(y, s);
   bool z0 = recover_x(x, y, sign);
   bool res;
-  if (z0 == false)
-  {
-    res = false;
-  }
-  else
+  if (z0)
   {
     uint64_t *outx = out;
     uint64_t *outy = out + 5U;
@@ -571,6 +567,10 @@ bool Hacl_Impl_Ed25519_PointDecompress_point_decompress(uint64_t *out, uint8_t *
     fmul0(outt, x, y);
     res = true;
   }
+  else
+  {
+    res = false;
+  }
   bool res0 = res;
   return res0;
 }
@@ -1150,11 +1150,7 @@ static inline bool gte_q(uint64_t *s)
   {
     return false;
   }
-  if (s3 > 0x00000000000000ULL)
-  {
-    return true;
-  }
-  if (s2 > 0x000000000014deULL)
+  if (s3 > 0x00000000000000ULL || s2 > 0x000000000014deULL)
   {
     return true;
   }
@@ -1170,11 +1166,7 @@ static inline bool gte_q(uint64_t *s)
   {
     return false;
   }
-  if (s0 >= 0x12631a5cf5d3edULL)
-  {
-    return true;
-  }
-  return false;
+  return s0 >= 0x12631a5cf5d3edULL;
 }
 
 static inline bool eq(uint64_t *a, uint64_t *b)
diff --git a/src/Hacl_FFDHE.c b/src/Hacl_FFDHE.c
index 098aa607..cb79d42e 100644
--- a/src/Hacl_FFDHE.c
+++ b/src/Hacl_FFDHE.c
@@ -202,7 +202,7 @@ static inline uint64_t ffdhe_check_pk(Spec_FFDHE_ffdhe_alg a, uint64_t *pk_n, ui
   {
     uint64_t beq = FStar_UInt64_eq_mask(b2[i], pk_n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(b2[i], pk_n[i]);
-    acc0 = (beq & acc0) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+    acc0 = (beq & acc0) | (~beq & blt);
   }
   uint64_t res = acc0;
   uint64_t m0 = res;
@@ -211,7 +211,7 @@ static inline uint64_t ffdhe_check_pk(Spec_FFDHE_ffdhe_alg a, uint64_t *pk_n, ui
   {
     uint64_t beq = FStar_UInt64_eq_mask(pk_n[i], p_n1[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(pk_n[i], p_n1[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+    acc = (beq & acc) | (~beq & blt);
   }
   uint64_t m1 = acc;
   return m0 & m1;
diff --git a/src/Hacl_HMAC.c b/src/Hacl_HMAC.c
index b03bc7ac..e4f37c61 100644
--- a/src/Hacl_HMAC.c
+++ b/src/Hacl_HMAC.c
@@ -609,7 +609,7 @@ Hacl_HMAC_compute_blake2s_32(
   if (data_len == 0U)
   {
     uint32_t wv[16U] = { 0U };
-    Hacl_Hash_Blake2s_update_last(64U, wv, s0, 0ULL, 64U, ipad);
+    Hacl_Hash_Blake2s_update_last(64U, wv, s0, false, 0ULL, 64U, ipad);
   }
   else
   {
@@ -644,6 +644,7 @@ Hacl_HMAC_compute_blake2s_32(
     Hacl_Hash_Blake2s_update_last(rem_len,
       wv1,
       s0,
+      false,
       (uint64_t)64U + (uint64_t)full_blocks_len,
       rem_len,
       rem);
@@ -682,6 +683,7 @@ Hacl_HMAC_compute_blake2s_32(
   Hacl_Hash_Blake2s_update_last(rem_len,
     wv1,
     s0,
+    false,
     (uint64_t)64U + (uint64_t)full_blocks_len,
     rem_len,
     rem);
@@ -752,7 +754,13 @@ Hacl_HMAC_compute_blake2b_32(
   if (data_len == 0U)
   {
     uint64_t wv[16U] = { 0U };
-    Hacl_Hash_Blake2b_update_last(128U, wv, s0, FStar_UInt128_uint64_to_uint128(0ULL), 128U, ipad);
+    Hacl_Hash_Blake2b_update_last(128U,
+      wv,
+      s0,
+      false,
+      FStar_UInt128_uint64_to_uint128(0ULL),
+      128U,
+      ipad);
   }
   else
   {
@@ -787,6 +795,7 @@ Hacl_HMAC_compute_blake2b_32(
     Hacl_Hash_Blake2b_update_last(rem_len,
       wv1,
       s0,
+      false,
       FStar_UInt128_add(FStar_UInt128_uint64_to_uint128((uint64_t)128U),
         FStar_UInt128_uint64_to_uint128((uint64_t)full_blocks_len)),
       rem_len,
@@ -826,6 +835,7 @@ Hacl_HMAC_compute_blake2b_32(
   Hacl_Hash_Blake2b_update_last(rem_len,
     wv1,
     s0,
+    false,
     FStar_UInt128_add(FStar_UInt128_uint64_to_uint128((uint64_t)128U),
       FStar_UInt128_uint64_to_uint128((uint64_t)full_blocks_len)),
     rem_len,
diff --git a/src/Hacl_HMAC_Blake2b_256.c b/src/Hacl_HMAC_Blake2b_256.c
index 6197490a..d5a00213 100644
--- a/src/Hacl_HMAC_Blake2b_256.c
+++ b/src/Hacl_HMAC_Blake2b_256.c
@@ -96,6 +96,7 @@ Hacl_HMAC_Blake2b_256_compute_blake2b_256(
     Hacl_Hash_Blake2b_Simd256_update_last(128U,
       wv,
       s0,
+      false,
       FStar_UInt128_uint64_to_uint128(0ULL),
       128U,
       ipad);
@@ -138,6 +139,7 @@ Hacl_HMAC_Blake2b_256_compute_blake2b_256(
     Hacl_Hash_Blake2b_Simd256_update_last(rem_len,
       wv1,
       s0,
+      false,
       FStar_UInt128_add(FStar_UInt128_uint64_to_uint128((uint64_t)128U),
         FStar_UInt128_uint64_to_uint128((uint64_t)full_blocks_len)),
       rem_len,
@@ -182,6 +184,7 @@ Hacl_HMAC_Blake2b_256_compute_blake2b_256(
   Hacl_Hash_Blake2b_Simd256_update_last(rem_len,
     wv1,
     s0,
+    false,
     FStar_UInt128_add(FStar_UInt128_uint64_to_uint128((uint64_t)128U),
       FStar_UInt128_uint64_to_uint128((uint64_t)full_blocks_len)),
     rem_len,
diff --git a/src/Hacl_HMAC_Blake2s_128.c b/src/Hacl_HMAC_Blake2s_128.c
index 0741bffb..489cf3b0 100644
--- a/src/Hacl_HMAC_Blake2s_128.c
+++ b/src/Hacl_HMAC_Blake2s_128.c
@@ -92,7 +92,7 @@ Hacl_HMAC_Blake2s_128_compute_blake2s_128(
   if (data_len == 0U)
   {
     KRML_PRE_ALIGN(16) Lib_IntVector_Intrinsics_vec128 wv[4U] KRML_POST_ALIGN(16) = { 0U };
-    Hacl_Hash_Blake2s_Simd128_update_last(64U, wv, s0, 0ULL, 64U, ipad);
+    Hacl_Hash_Blake2s_Simd128_update_last(64U, wv, s0, false, 0ULL, 64U, ipad);
   }
   else
   {
@@ -127,6 +127,7 @@ Hacl_HMAC_Blake2s_128_compute_blake2s_128(
     Hacl_Hash_Blake2s_Simd128_update_last(rem_len,
       wv1,
       s0,
+      false,
       (uint64_t)64U + (uint64_t)full_blocks_len,
       rem_len,
       rem);
@@ -165,6 +166,7 @@ Hacl_HMAC_Blake2s_128_compute_blake2s_128(
   Hacl_Hash_Blake2s_Simd128_update_last(rem_len,
     wv1,
     s0,
+    false,
     (uint64_t)64U + (uint64_t)full_blocks_len,
     rem_len,
     rem);
diff --git a/src/Hacl_Hash_Blake2b.c b/src/Hacl_Hash_Blake2b.c
index d490a1a5..e13f16fd 100644
--- a/src/Hacl_Hash_Blake2b.c
+++ b/src/Hacl_Hash_Blake2b.c
@@ -29,7 +29,14 @@
 #include "lib_memzero0.h"
 
 static void
-update_block(uint64_t *wv, uint64_t *hash, bool flag, FStar_UInt128_uint128 totlen, uint8_t *d)
+update_block(
+  uint64_t *wv,
+  uint64_t *hash,
+  bool flag,
+  bool last_node,
+  FStar_UInt128_uint128 totlen,
+  uint8_t *d
+)
 {
   uint64_t m_w[16U] = { 0U };
   KRML_MAYBE_FOR16(i,
@@ -52,7 +59,15 @@ update_block(uint64_t *wv, uint64_t *hash, bool flag, FStar_UInt128_uint128 totl
   {
     wv_14 = 0ULL;
   }
-  uint64_t wv_15 = 0ULL;
+  uint64_t wv_15;
+  if (last_node)
+  {
+    wv_15 = 0xFFFFFFFFFFFFFFFFULL;
+  }
+  else
+  {
+    wv_15 = 0ULL;
+  }
   mask[0U] = FStar_UInt128_uint128_to_uint64(totlen);
   mask[1U] = FStar_UInt128_uint128_to_uint64(FStar_UInt128_shift_right(totlen, 64U));
   mask[2U] = wv_14;
@@ -647,11 +662,11 @@ static void update_key(uint64_t *wv, uint64_t *hash, uint32_t kk, uint8_t *k, ui
   memcpy(b, k, kk * sizeof (uint8_t));
   if (ll == 0U)
   {
-    update_block(wv, hash, true, lb, b);
+    update_block(wv, hash, true, false, lb, b);
   }
   else
   {
-    update_block(wv, hash, false, lb, b);
+    update_block(wv, hash, false, false, lb, b);
   }
   Lib_Memzero0_memzero(b, 128U, uint8_t, void *);
 }
@@ -674,7 +689,7 @@ Hacl_Hash_Blake2b_update_multi(
       FStar_UInt128_add_mod(prev,
         FStar_UInt128_uint64_to_uint128((uint64_t)((i + 1U) * 128U)));
     uint8_t *b = blocks + i * 128U;
-    update_block(wv, hash, false, totlen, b);
+    update_block(wv, hash, false, false, totlen, b);
   }
 }
 
@@ -683,6 +698,7 @@ Hacl_Hash_Blake2b_update_last(
   uint32_t len,
   uint64_t *wv,
   uint64_t *hash,
+  bool last_node,
   FStar_UInt128_uint128 prev,
   uint32_t rem,
   uint8_t *d
@@ -693,7 +709,7 @@ Hacl_Hash_Blake2b_update_last(
   memcpy(b, last, rem * sizeof (uint8_t));
   FStar_UInt128_uint128
   totlen = FStar_UInt128_add_mod(prev, FStar_UInt128_uint64_to_uint128((uint64_t)len));
-  update_block(wv, hash, true, totlen, b);
+  update_block(wv, hash, true, last_node, totlen, b);
   Lib_Memzero0_memzero(b, 128U, uint8_t, void *);
 }
 
@@ -727,7 +743,7 @@ update_blocks(
     rem = rem0;
   }
   Hacl_Hash_Blake2b_update_multi(len, wv, hash, prev, blocks, nb);
-  Hacl_Hash_Blake2b_update_last(len, wv, hash, prev, rem, blocks);
+  Hacl_Hash_Blake2b_update_last(len, wv, hash, false, prev, rem, blocks);
 }
 
 static inline void
@@ -762,16 +778,19 @@ void Hacl_Hash_Blake2b_finish(uint32_t nn, uint8_t *output, uint64_t *hash)
 }
 
 static Hacl_Hash_Blake2b_state_t
-*malloc_raw(
-  Hacl_Hash_Blake2b_index kk,
-  K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_ key
-)
+*malloc_raw(Hacl_Hash_Blake2b_index kk, Hacl_Hash_Blake2b_params_and_key key)
 {
   uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC(128U, sizeof (uint8_t));
   uint64_t *wv = (uint64_t *)KRML_HOST_CALLOC(16U, sizeof (uint64_t));
   uint64_t *b = (uint64_t *)KRML_HOST_CALLOC(16U, sizeof (uint64_t));
   Hacl_Hash_Blake2b_block_state_t
-  block_state = { .fst = kk.key_length, .snd = kk.digest_length, .thd = { .fst = wv, .snd = b } };
+  block_state =
+    {
+      .fst = kk.key_length,
+      .snd = kk.digest_length,
+      .thd = kk.last_node,
+      .f3 = { .fst = wv, .snd = b }
+    };
   uint8_t kk10 = kk.key_length;
   uint32_t ite;
   if (kk10 != 0U)
@@ -790,7 +809,8 @@ static Hacl_Hash_Blake2b_state_t
   Hacl_Hash_Blake2b_blake2_params *p1 = key.fst;
   uint8_t kk1 = p1->key_length;
   uint8_t nn = p1->digest_length;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
+  bool last_node = block_state.thd;
+  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint32_t kk2 = (uint32_t)i.key_length;
   uint8_t *k_1 = key.snd;
   if (!(kk2 == 0U))
@@ -800,7 +820,7 @@ static Hacl_Hash_Blake2b_state_t
     memcpy(buf, k_1, kk2 * sizeof (uint8_t));
   }
   Hacl_Hash_Blake2b_blake2_params pv = p1[0U];
-  init_with_params(block_state.thd.snd, pv);
+  init_with_params(block_state.f3.snd, pv);
   return p;
 }
 
@@ -820,14 +840,16 @@ The caller must satisfy the following requirements.
 
 */
 Hacl_Hash_Blake2b_state_t
-*Hacl_Hash_Blake2b_malloc_with_params_and_key(Hacl_Hash_Blake2b_blake2_params *p, uint8_t *k)
+*Hacl_Hash_Blake2b_malloc_with_params_and_key(
+  Hacl_Hash_Blake2b_blake2_params *p,
+  bool last_node,
+  uint8_t *k
+)
 {
   Hacl_Hash_Blake2b_blake2_params pv = p[0U];
   Hacl_Hash_Blake2b_index
-  i1 = { .key_length = pv.key_length, .digest_length = pv.digest_length };
-  return
-    malloc_raw(i1,
-      ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = p, .snd = k }));
+  i1 = { .key_length = pv.key_length, .digest_length = pv.digest_length, .last_node = last_node };
+  return malloc_raw(i1, ((Hacl_Hash_Blake2b_params_and_key){ .fst = p, .snd = k }));
 }
 
 /**
@@ -844,7 +866,7 @@ The caller must satisfy the following requirements.
 Hacl_Hash_Blake2b_state_t *Hacl_Hash_Blake2b_malloc_with_key(uint8_t *k, uint8_t kk)
 {
   uint8_t nn = 64U;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk, .digest_length = nn };
+  Hacl_Hash_Blake2b_index i = { .key_length = kk, .digest_length = nn, .last_node = false };
   uint8_t salt[16U] = { 0U };
   uint8_t personal[16U] = { 0U };
   Hacl_Hash_Blake2b_blake2_params
@@ -855,7 +877,7 @@ Hacl_Hash_Blake2b_state_t *Hacl_Hash_Blake2b_malloc_with_key(uint8_t *k, uint8_t
       .personal = personal
     };
   Hacl_Hash_Blake2b_blake2_params p0 = p;
-  Hacl_Hash_Blake2b_state_t *s = Hacl_Hash_Blake2b_malloc_with_params_and_key(&p0, k);
+  Hacl_Hash_Blake2b_state_t *s = Hacl_Hash_Blake2b_malloc_with_params_and_key(&p0, false, k);
   return s;
 }
 
@@ -872,28 +894,30 @@ Hacl_Hash_Blake2b_state_t *Hacl_Hash_Blake2b_malloc(void)
 static Hacl_Hash_Blake2b_index index_of_state(Hacl_Hash_Blake2b_state_t *s)
 {
   Hacl_Hash_Blake2b_block_state_t block_state = (*s).block_state;
+  bool last_node = block_state.thd;
   uint8_t nn = block_state.snd;
   uint8_t kk1 = block_state.fst;
-  return ((Hacl_Hash_Blake2b_index){ .key_length = kk1, .digest_length = nn });
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk1, .digest_length = nn, .last_node = last_node });
 }
 
-static void
-reset_raw(
-  Hacl_Hash_Blake2b_state_t *state,
-  K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_ key
-)
+static void reset_raw(Hacl_Hash_Blake2b_state_t *state, Hacl_Hash_Blake2b_params_and_key key)
 {
   Hacl_Hash_Blake2b_state_t scrut = *state;
   uint8_t *buf = scrut.buf;
   Hacl_Hash_Blake2b_block_state_t block_state = scrut.block_state;
+  bool last_node0 = block_state.thd;
   uint8_t nn0 = block_state.snd;
   uint8_t kk10 = block_state.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk10, .digest_length = nn0 };
+  Hacl_Hash_Blake2b_index
+  i = { .key_length = kk10, .digest_length = nn0, .last_node = last_node0 };
   KRML_MAYBE_UNUSED_VAR(i);
   Hacl_Hash_Blake2b_blake2_params *p = key.fst;
   uint8_t kk1 = p->key_length;
   uint8_t nn = p->digest_length;
-  Hacl_Hash_Blake2b_index i1 = { .key_length = kk1, .digest_length = nn };
+  bool last_node = block_state.thd;
+  Hacl_Hash_Blake2b_index
+  i1 = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint32_t kk2 = (uint32_t)i1.key_length;
   uint8_t *k_1 = key.snd;
   if (!(kk2 == 0U))
@@ -903,7 +927,7 @@ reset_raw(
     memcpy(buf, k_1, kk2 * sizeof (uint8_t));
   }
   Hacl_Hash_Blake2b_blake2_params pv = p[0U];
-  init_with_params(block_state.thd.snd, pv);
+  init_with_params(block_state.f3.snd, pv);
   uint8_t kk11 = i.key_length;
   uint32_t ite;
   if (kk11 != 0U)
@@ -921,7 +945,7 @@ reset_raw(
 
 /**
  General-purpose re-initialization function with parameters and
-key. You cannot change digest_length or key_length, meaning those values in
+key. You cannot change digest_length, key_length, or last_node, meaning those values in
 the parameters object must be the same as originally decided via one of the
 malloc functions. All other values of the parameter can be changed. The behavior
 is unspecified if you violate this precondition.
@@ -934,7 +958,7 @@ Hacl_Hash_Blake2b_reset_with_key_and_params(
 )
 {
   index_of_state(s);
-  reset_raw(s, ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = p, .snd = k }));
+  reset_raw(s, ((Hacl_Hash_Blake2b_params_and_key){ .fst = p, .snd = k }));
 }
 
 /**
@@ -957,7 +981,7 @@ void Hacl_Hash_Blake2b_reset_with_key(Hacl_Hash_Blake2b_state_t *s, uint8_t *k)
       .personal = personal
     };
   Hacl_Hash_Blake2b_blake2_params p0 = p;
-  reset_raw(s, ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = &p0, .snd = k }));
+  reset_raw(s, ((Hacl_Hash_Blake2b_params_and_key){ .fst = &p0, .snd = k }));
 }
 
 /**
@@ -1040,7 +1064,7 @@ Hacl_Hash_Blake2b_update(Hacl_Hash_Blake2b_state_t *state, uint8_t *chunk, uint3
     if (!(sz1 == 0U))
     {
       uint64_t prevlen = total_len1 - (uint64_t)sz1;
-      K____uint64_t___uint64_t_ acc = block_state1.thd;
+      K____uint64_t___uint64_t_ acc = block_state1.f3;
       uint64_t *wv = acc.fst;
       uint64_t *hash = acc.snd;
       uint32_t nb = 1U;
@@ -1065,7 +1089,7 @@ Hacl_Hash_Blake2b_update(Hacl_Hash_Blake2b_state_t *state, uint8_t *chunk, uint3
     uint32_t data2_len = chunk_len - data1_len;
     uint8_t *data1 = chunk;
     uint8_t *data2 = chunk + data1_len;
-    K____uint64_t___uint64_t_ acc = block_state1.thd;
+    K____uint64_t___uint64_t_ acc = block_state1.f3;
     uint64_t *wv = acc.fst;
     uint64_t *hash = acc.snd;
     uint32_t nb = data1_len / 128U;
@@ -1133,7 +1157,7 @@ Hacl_Hash_Blake2b_update(Hacl_Hash_Blake2b_state_t *state, uint8_t *chunk, uint3
     if (!(sz1 == 0U))
     {
       uint64_t prevlen = total_len1 - (uint64_t)sz1;
-      K____uint64_t___uint64_t_ acc = block_state1.thd;
+      K____uint64_t___uint64_t_ acc = block_state1.f3;
       uint64_t *wv = acc.fst;
       uint64_t *hash = acc.snd;
       uint32_t nb = 1U;
@@ -1159,7 +1183,7 @@ Hacl_Hash_Blake2b_update(Hacl_Hash_Blake2b_state_t *state, uint8_t *chunk, uint3
     uint32_t data2_len = chunk_len - diff - data1_len;
     uint8_t *data1 = chunk2;
     uint8_t *data2 = chunk2 + data1_len;
-    K____uint64_t___uint64_t_ acc = block_state1.thd;
+    K____uint64_t___uint64_t_ acc = block_state1.f3;
     uint64_t *wv = acc.fst;
     uint64_t *hash = acc.snd;
     uint32_t nb = data1_len / 128U;
@@ -1190,16 +1214,20 @@ at least `digest_length` bytes, where `digest_length` was determined by your
 choice of `malloc` function. Concretely, if you used `malloc` or
 `malloc_with_key`, then the expected length is 32 for S, or 64 for B (default
 digest length). If you used `malloc_with_params_and_key`, then the expected
-length is whatever you chose for the `digest_length` field of your
-parameters.
+length is whatever you chose for the `digest_length` field of your parameters.
+For convenience, this function returns `digest_length`. When in doubt, callers
+can pass an array of size HACL_BLAKE2B_32_OUT_BYTES, then use the return value
+to see how many bytes were actually written.
 */
-void Hacl_Hash_Blake2b_digest(Hacl_Hash_Blake2b_state_t *state, uint8_t *output)
+uint8_t Hacl_Hash_Blake2b_digest(Hacl_Hash_Blake2b_state_t *s, uint8_t *dst)
 {
-  Hacl_Hash_Blake2b_block_state_t block_state0 = (*state).block_state;
-  uint8_t nn = block_state0.snd;
-  uint8_t kk1 = block_state0.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
-  Hacl_Hash_Blake2b_state_t scrut = *state;
+  Hacl_Hash_Blake2b_block_state_t block_state0 = (*s).block_state;
+  bool last_node0 = block_state0.thd;
+  uint8_t nn0 = block_state0.snd;
+  uint8_t kk0 = block_state0.fst;
+  Hacl_Hash_Blake2b_index
+  i1 = { .key_length = kk0, .digest_length = nn0, .last_node = last_node0 };
+  Hacl_Hash_Blake2b_state_t scrut = *s;
   Hacl_Hash_Blake2b_block_state_t block_state = scrut.block_state;
   uint8_t *buf_ = scrut.buf;
   uint64_t total_len = scrut.total_len;
@@ -1217,9 +1245,14 @@ void Hacl_Hash_Blake2b_digest(Hacl_Hash_Blake2b_state_t *state, uint8_t *output)
   uint64_t b[16U] = { 0U };
   Hacl_Hash_Blake2b_block_state_t
   tmp_block_state =
-    { .fst = i.key_length, .snd = i.digest_length, .thd = { .fst = wv0, .snd = b } };
-  uint64_t *src_b = block_state.thd.snd;
-  uint64_t *dst_b = tmp_block_state.thd.snd;
+    {
+      .fst = i1.key_length,
+      .snd = i1.digest_length,
+      .thd = i1.last_node,
+      .f3 = { .fst = wv0, .snd = b }
+    };
+  uint64_t *src_b = block_state.f3.snd;
+  uint64_t *dst_b = tmp_block_state.f3.snd;
   memcpy(dst_b, src_b, 16U * sizeof (uint64_t));
   uint64_t prev_len = total_len - (uint64_t)r;
   uint32_t ite;
@@ -1233,7 +1266,7 @@ void Hacl_Hash_Blake2b_digest(Hacl_Hash_Blake2b_state_t *state, uint8_t *output)
   }
   uint8_t *buf_last = buf_1 + r - ite;
   uint8_t *buf_multi = buf_1;
-  K____uint64_t___uint64_t_ acc0 = tmp_block_state.thd;
+  K____uint64_t___uint64_t_ acc0 = tmp_block_state.f3;
   uint64_t *wv1 = acc0.fst;
   uint64_t *hash0 = acc0.snd;
   uint32_t nb = 0U;
@@ -1244,17 +1277,35 @@ void Hacl_Hash_Blake2b_digest(Hacl_Hash_Blake2b_state_t *state, uint8_t *output)
     buf_multi,
     nb);
   uint64_t prev_len_last = total_len - (uint64_t)r;
-  K____uint64_t___uint64_t_ acc = tmp_block_state.thd;
+  K____uint64_t___uint64_t_ acc = tmp_block_state.f3;
+  bool last_node1 = tmp_block_state.thd;
   uint64_t *wv = acc.fst;
   uint64_t *hash = acc.snd;
   Hacl_Hash_Blake2b_update_last(r,
     wv,
     hash,
+    last_node1,
     FStar_UInt128_uint64_to_uint128(prev_len_last),
     r,
     buf_last);
-  uint8_t nn0 = tmp_block_state.snd;
-  Hacl_Hash_Blake2b_finish((uint32_t)nn0, output, tmp_block_state.thd.snd);
+  uint8_t nn1 = tmp_block_state.snd;
+  Hacl_Hash_Blake2b_finish((uint32_t)nn1, dst, tmp_block_state.f3.snd);
+  Hacl_Hash_Blake2b_block_state_t block_state1 = (*s).block_state;
+  bool last_node = block_state1.thd;
+  uint8_t nn = block_state1.snd;
+  uint8_t kk = block_state1.fst;
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk, .digest_length = nn, .last_node = last_node }).digest_length;
+}
+
+Hacl_Hash_Blake2b_index Hacl_Hash_Blake2b_info(Hacl_Hash_Blake2b_state_t *s)
+{
+  Hacl_Hash_Blake2b_block_state_t block_state = (*s).block_state;
+  bool last_node = block_state.thd;
+  uint8_t nn = block_state.snd;
+  uint8_t kk = block_state.fst;
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk, .digest_length = nn, .last_node = last_node });
 }
 
 /**
@@ -1265,8 +1316,8 @@ void Hacl_Hash_Blake2b_free(Hacl_Hash_Blake2b_state_t *state)
   Hacl_Hash_Blake2b_state_t scrut = *state;
   uint8_t *buf = scrut.buf;
   Hacl_Hash_Blake2b_block_state_t block_state = scrut.block_state;
-  uint64_t *b = block_state.thd.snd;
-  uint64_t *wv = block_state.thd.fst;
+  uint64_t *b = block_state.f3.snd;
+  uint64_t *wv = block_state.f3.fst;
   KRML_HOST_FREE(wv);
   KRML_HOST_FREE(b);
   KRML_HOST_FREE(buf);
@@ -1282,17 +1333,24 @@ Hacl_Hash_Blake2b_state_t *Hacl_Hash_Blake2b_copy(Hacl_Hash_Blake2b_state_t *sta
   Hacl_Hash_Blake2b_block_state_t block_state0 = scrut.block_state;
   uint8_t *buf0 = scrut.buf;
   uint64_t total_len0 = scrut.total_len;
+  bool last_node = block_state0.thd;
   uint8_t nn = block_state0.snd;
   uint8_t kk1 = block_state0.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
+  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC(128U, sizeof (uint8_t));
   memcpy(buf, buf0, 128U * sizeof (uint8_t));
   uint64_t *wv = (uint64_t *)KRML_HOST_CALLOC(16U, sizeof (uint64_t));
   uint64_t *b = (uint64_t *)KRML_HOST_CALLOC(16U, sizeof (uint64_t));
   Hacl_Hash_Blake2b_block_state_t
-  block_state = { .fst = i.key_length, .snd = i.digest_length, .thd = { .fst = wv, .snd = b } };
-  uint64_t *src_b = block_state0.thd.snd;
-  uint64_t *dst_b = block_state.thd.snd;
+  block_state =
+    {
+      .fst = i.key_length,
+      .snd = i.digest_length,
+      .thd = i.last_node,
+      .f3 = { .fst = wv, .snd = b }
+    };
+  uint64_t *src_b = block_state0.f3.snd;
+  uint64_t *dst_b = block_state.f3.snd;
   memcpy(dst_b, src_b, 16U * sizeof (uint64_t));
   Hacl_Hash_Blake2b_state_t
   s = { .block_state = block_state, .buf = buf, .total_len = total_len0 };
@@ -1335,10 +1393,10 @@ Hacl_Hash_Blake2b_hash_with_key(
 Write the BLAKE2b digest of message `input` using key `key` and
 parameters `params` into `output`. The `key` array must be of length
 `params.key_length`. The `output` array must be of length
-`params.digest_length`. 
+`params.digest_length`.
 */
 void
-Hacl_Hash_Blake2b_hash_with_key_and_paramas(
+Hacl_Hash_Blake2b_hash_with_key_and_params(
   uint8_t *output,
   uint8_t *input,
   uint32_t input_len,
diff --git a/src/Hacl_Hash_Blake2b_Simd256.c b/src/Hacl_Hash_Blake2b_Simd256.c
index 0afd93bc..35608aea 100644
--- a/src/Hacl_Hash_Blake2b_Simd256.c
+++ b/src/Hacl_Hash_Blake2b_Simd256.c
@@ -34,6 +34,7 @@ update_block(
   Lib_IntVector_Intrinsics_vec256 *wv,
   Lib_IntVector_Intrinsics_vec256 *hash,
   bool flag,
+  bool last_node,
   FStar_UInt128_uint128 totlen,
   uint8_t *d
 )
@@ -59,7 +60,15 @@ update_block(
   {
     wv_14 = 0ULL;
   }
-  uint64_t wv_15 = 0ULL;
+  uint64_t wv_15;
+  if (last_node)
+  {
+    wv_15 = 0xFFFFFFFFFFFFFFFFULL;
+  }
+  else
+  {
+    wv_15 = 0ULL;
+  }
   mask =
     Lib_IntVector_Intrinsics_vec256_load64s(FStar_UInt128_uint128_to_uint64(totlen),
       FStar_UInt128_uint128_to_uint64(FStar_UInt128_shift_right(totlen, 64U)),
@@ -372,11 +381,11 @@ update_key(
   memcpy(b, k, kk * sizeof (uint8_t));
   if (ll == 0U)
   {
-    update_block(wv, hash, true, lb, b);
+    update_block(wv, hash, true, false, lb, b);
   }
   else
   {
-    update_block(wv, hash, false, lb, b);
+    update_block(wv, hash, false, false, lb, b);
   }
   Lib_Memzero0_memzero(b, 128U, uint8_t, void *);
 }
@@ -399,7 +408,7 @@ Hacl_Hash_Blake2b_Simd256_update_multi(
       FStar_UInt128_add_mod(prev,
         FStar_UInt128_uint64_to_uint128((uint64_t)((i + 1U) * 128U)));
     uint8_t *b = blocks + i * 128U;
-    update_block(wv, hash, false, totlen, b);
+    update_block(wv, hash, false, false, totlen, b);
   }
 }
 
@@ -408,6 +417,7 @@ Hacl_Hash_Blake2b_Simd256_update_last(
   uint32_t len,
   Lib_IntVector_Intrinsics_vec256 *wv,
   Lib_IntVector_Intrinsics_vec256 *hash,
+  bool last_node,
   FStar_UInt128_uint128 prev,
   uint32_t rem,
   uint8_t *d
@@ -418,7 +428,7 @@ Hacl_Hash_Blake2b_Simd256_update_last(
   memcpy(b, last, rem * sizeof (uint8_t));
   FStar_UInt128_uint128
   totlen = FStar_UInt128_add_mod(prev, FStar_UInt128_uint64_to_uint128((uint64_t)len));
-  update_block(wv, hash, true, totlen, b);
+  update_block(wv, hash, true, last_node, totlen, b);
   Lib_Memzero0_memzero(b, 128U, uint8_t, void *);
 }
 
@@ -452,7 +462,7 @@ update_blocks(
     rem = rem0;
   }
   Hacl_Hash_Blake2b_Simd256_update_multi(len, wv, hash, prev, blocks, nb);
-  Hacl_Hash_Blake2b_Simd256_update_last(len, wv, hash, prev, rem, blocks);
+  Hacl_Hash_Blake2b_Simd256_update_last(len, wv, hash, false, prev, rem, blocks);
 }
 
 static inline void
@@ -593,10 +603,7 @@ Lib_IntVector_Intrinsics_vec256 *Hacl_Hash_Blake2b_Simd256_malloc_with_key(void)
 }
 
 static Hacl_Hash_Blake2b_Simd256_state_t
-*malloc_raw(
-  Hacl_Hash_Blake2b_index kk,
-  K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_ key
-)
+*malloc_raw(Hacl_Hash_Blake2b_index kk, Hacl_Hash_Blake2b_params_and_key key)
 {
   uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC(128U, sizeof (uint8_t));
   Lib_IntVector_Intrinsics_vec256
@@ -610,7 +617,13 @@ static Hacl_Hash_Blake2b_Simd256_state_t
       sizeof (Lib_IntVector_Intrinsics_vec256) * 4U);
   memset(b, 0U, 4U * sizeof (Lib_IntVector_Intrinsics_vec256));
   Hacl_Hash_Blake2b_Simd256_block_state_t
-  block_state = { .fst = kk.key_length, .snd = kk.digest_length, .thd = { .fst = wv, .snd = b } };
+  block_state =
+    {
+      .fst = kk.key_length,
+      .snd = kk.digest_length,
+      .thd = kk.last_node,
+      .f3 = { .fst = wv, .snd = b }
+    };
   uint8_t kk10 = kk.key_length;
   uint32_t ite;
   if (kk10 != 0U)
@@ -632,7 +645,8 @@ static Hacl_Hash_Blake2b_Simd256_state_t
   Hacl_Hash_Blake2b_blake2_params *p1 = key.fst;
   uint8_t kk1 = p1->key_length;
   uint8_t nn = p1->digest_length;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
+  bool last_node = block_state.thd;
+  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint32_t kk2 = (uint32_t)i.key_length;
   uint8_t *k_1 = key.snd;
   if (!(kk2 == 0U))
@@ -642,42 +656,56 @@ static Hacl_Hash_Blake2b_Simd256_state_t
     memcpy(buf, k_1, kk2 * sizeof (uint8_t));
   }
   Hacl_Hash_Blake2b_blake2_params pv = p1[0U];
-  init_with_params(block_state.thd.snd, pv);
+  init_with_params(block_state.f3.snd, pv);
   return p;
 }
 
 /**
- State allocation function when there are parameters and a key. The
-length of the key k MUST match the value of the field key_length in the
-parameters. Furthermore, there is a static (not dynamically checked) requirement
-that key_length does not exceed max_key (256 for S, 64 for B).)
+ General-purpose allocation function that gives control over all
+Blake2 parameters, including the key. Further resettings of the state SHALL be
+done with `reset_with_params_and_key`, and SHALL feature the exact same values
+for the `key_length` and `digest_length` fields as passed here. In other words,
+once you commit to a digest and key length, the only way to change these
+parameters is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The length of the key k MUST match the value of the field key_length in the
+  parameters.
+- The key_length must not exceed 256 for S, 64 for B.
+- The digest_length must not exceed 256 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2b_Simd256_state_t
 *Hacl_Hash_Blake2b_Simd256_malloc_with_params_and_key(
   Hacl_Hash_Blake2b_blake2_params *p,
+  bool last_node,
   uint8_t *k
 )
 {
   Hacl_Hash_Blake2b_blake2_params pv = p[0U];
   Hacl_Hash_Blake2b_index
-  i1 = { .key_length = pv.key_length, .digest_length = pv.digest_length };
-  return
-    malloc_raw(i1,
-      ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = p, .snd = k }));
+  i1 = { .key_length = pv.key_length, .digest_length = pv.digest_length, .last_node = last_node };
+  return malloc_raw(i1, ((Hacl_Hash_Blake2b_params_and_key){ .fst = p, .snd = k }));
 }
 
 /**
- State allocation function when there is just a custom key. All
-other parameters are set to their respective default values, meaning the output
-length is the maximum allowed output (256 for S, 64 for B).
+ Specialized allocation function that picks default values for all
+parameters, except for the key_length. Further resettings of the state SHALL be
+done with `reset_with_key`, and SHALL feature the exact same key length `kk` as
+passed here. In other words, once you commit to a key length, the only way to
+change this parameter is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The key_length must not exceed 256 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2b_Simd256_state_t
 *Hacl_Hash_Blake2b_Simd256_malloc_with_key0(uint8_t *k, uint8_t kk)
 {
   uint8_t nn = 64U;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk, .digest_length = nn };
-  uint8_t *salt = (uint8_t *)KRML_HOST_CALLOC(16U, sizeof (uint8_t));
-  uint8_t *personal = (uint8_t *)KRML_HOST_CALLOC(16U, sizeof (uint8_t));
+  Hacl_Hash_Blake2b_index i = { .key_length = kk, .digest_length = nn, .last_node = false };
+  uint8_t salt[16U] = { 0U };
+  uint8_t personal[16U] = { 0U };
   Hacl_Hash_Blake2b_blake2_params
   p =
     {
@@ -685,21 +713,16 @@ Hacl_Hash_Blake2b_Simd256_state_t
       .leaf_length = 0U, .node_offset = 0ULL, .node_depth = 0U, .inner_length = 0U, .salt = salt,
       .personal = personal
     };
-  Hacl_Hash_Blake2b_blake2_params
-  *p0 =
-    (Hacl_Hash_Blake2b_blake2_params *)KRML_HOST_MALLOC(sizeof (Hacl_Hash_Blake2b_blake2_params));
-  p0[0U] = p;
+  Hacl_Hash_Blake2b_blake2_params p0 = p;
   Hacl_Hash_Blake2b_Simd256_state_t
-  *s = Hacl_Hash_Blake2b_Simd256_malloc_with_params_and_key(p0, k);
-  Hacl_Hash_Blake2b_blake2_params p1 = p0[0U];
-  KRML_HOST_FREE(p1.salt);
-  KRML_HOST_FREE(p1.personal);
-  KRML_HOST_FREE(p0);
+  *s = Hacl_Hash_Blake2b_Simd256_malloc_with_params_and_key(&p0, false, k);
   return s;
 }
 
 /**
-  State allocation function when there is no key
+ Specialized allocation function that picks default values for all
+parameters, and has no key. Effectively, this is what you want if you intend to
+use Blake2 as a hash function. Further resettings of the state SHALL be done with `reset`.
 */
 Hacl_Hash_Blake2b_Simd256_state_t *Hacl_Hash_Blake2b_Simd256_malloc(void)
 {
@@ -709,28 +732,31 @@ Hacl_Hash_Blake2b_Simd256_state_t *Hacl_Hash_Blake2b_Simd256_malloc(void)
 static Hacl_Hash_Blake2b_index index_of_state(Hacl_Hash_Blake2b_Simd256_state_t *s)
 {
   Hacl_Hash_Blake2b_Simd256_block_state_t block_state = (*s).block_state;
+  bool last_node = block_state.thd;
   uint8_t nn = block_state.snd;
   uint8_t kk1 = block_state.fst;
-  return ((Hacl_Hash_Blake2b_index){ .key_length = kk1, .digest_length = nn });
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk1, .digest_length = nn, .last_node = last_node });
 }
 
 static void
-reset_raw(
-  Hacl_Hash_Blake2b_Simd256_state_t *state,
-  K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_ key
-)
+reset_raw(Hacl_Hash_Blake2b_Simd256_state_t *state, Hacl_Hash_Blake2b_params_and_key key)
 {
   Hacl_Hash_Blake2b_Simd256_state_t scrut = *state;
   uint8_t *buf = scrut.buf;
   Hacl_Hash_Blake2b_Simd256_block_state_t block_state = scrut.block_state;
+  bool last_node0 = block_state.thd;
   uint8_t nn0 = block_state.snd;
   uint8_t kk10 = block_state.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk10, .digest_length = nn0 };
+  Hacl_Hash_Blake2b_index
+  i = { .key_length = kk10, .digest_length = nn0, .last_node = last_node0 };
   KRML_MAYBE_UNUSED_VAR(i);
   Hacl_Hash_Blake2b_blake2_params *p = key.fst;
   uint8_t kk1 = p->key_length;
   uint8_t nn = p->digest_length;
-  Hacl_Hash_Blake2b_index i1 = { .key_length = kk1, .digest_length = nn };
+  bool last_node = block_state.thd;
+  Hacl_Hash_Blake2b_index
+  i1 = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint32_t kk2 = (uint32_t)i1.key_length;
   uint8_t *k_1 = key.snd;
   if (!(kk2 == 0U))
@@ -740,7 +766,7 @@ reset_raw(
     memcpy(buf, k_1, kk2 * sizeof (uint8_t));
   }
   Hacl_Hash_Blake2b_blake2_params pv = p[0U];
-  init_with_params(block_state.thd.snd, pv);
+  init_with_params(block_state.f3.snd, pv);
   uint8_t kk11 = i.key_length;
   uint32_t ite;
   if (kk11 != 0U)
@@ -757,9 +783,11 @@ reset_raw(
 }
 
 /**
- Re-initialization function. The reinitialization API is tricky --
-you MUST reuse the same original parameters for digest (output) length and key
-length.
+ General-purpose re-initialization function with parameters and
+key. You cannot change digest_length, key_length, or last_node, meaning those values in
+the parameters object must be the same as originally decided via one of the
+malloc functions. All other values of the parameter can be changed. The behavior
+is unspecified if you violate this precondition.
 */
 void
 Hacl_Hash_Blake2b_Simd256_reset_with_key_and_params(
@@ -769,14 +797,15 @@ Hacl_Hash_Blake2b_Simd256_reset_with_key_and_params(
 )
 {
   index_of_state(s);
-  reset_raw(s, ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = p, .snd = k }));
+  reset_raw(s, ((Hacl_Hash_Blake2b_params_and_key){ .fst = p, .snd = k }));
 }
 
 /**
- Re-initialization function when there is a key. Note that the key
-size is not allowed to change, which is why this function does not take a key
-length -- the key has to be same key size that was originally passed to
-`malloc_with_key`
+ Specialized-purpose re-initialization function with no parameters,
+and a key. The key length must be the same as originally decided via your choice
+of malloc function. All other parameters are reset to their default values. The
+original call to malloc MUST have set digest_length to the default value. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2b_Simd256_reset_with_key(Hacl_Hash_Blake2b_Simd256_state_t *s, uint8_t *k)
 {
@@ -791,11 +820,16 @@ void Hacl_Hash_Blake2b_Simd256_reset_with_key(Hacl_Hash_Blake2b_Simd256_state_t
       .personal = personal
     };
   Hacl_Hash_Blake2b_blake2_params p0 = p;
-  reset_raw(s, ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = &p0, .snd = k }));
+  reset_raw(s, ((Hacl_Hash_Blake2b_params_and_key){ .fst = &p0, .snd = k }));
 }
 
 /**
-  Re-initialization function when there is no key
+ Specialized-purpose re-initialization function with no parameters
+and no key. This is what you want if you intend to use Blake2 as a hash
+function. The key length and digest length must have been set to their
+respective default values via your choice of malloc function (always true if you
+used `malloc`). All other parameters are reset to their default values. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2b_Simd256_reset(Hacl_Hash_Blake2b_Simd256_state_t *s)
 {
@@ -803,7 +837,7 @@ void Hacl_Hash_Blake2b_Simd256_reset(Hacl_Hash_Blake2b_Simd256_state_t *s)
 }
 
 /**
-  Update function when there is no key; 0 = success, 1 = max length exceeded
+  Update function; 0 = success, 1 = max length exceeded
 */
 Hacl_Streaming_Types_error_code
 Hacl_Hash_Blake2b_Simd256_update(
@@ -873,8 +907,7 @@ Hacl_Hash_Blake2b_Simd256_update(
     if (!(sz1 == 0U))
     {
       uint64_t prevlen = total_len1 - (uint64_t)sz1;
-      K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_
-      acc = block_state1.thd;
+      K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_ acc = block_state1.f3;
       Lib_IntVector_Intrinsics_vec256 *wv = acc.fst;
       Lib_IntVector_Intrinsics_vec256 *hash = acc.snd;
       uint32_t nb = 1U;
@@ -899,7 +932,7 @@ Hacl_Hash_Blake2b_Simd256_update(
     uint32_t data2_len = chunk_len - data1_len;
     uint8_t *data1 = chunk;
     uint8_t *data2 = chunk + data1_len;
-    K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_ acc = block_state1.thd;
+    K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_ acc = block_state1.f3;
     Lib_IntVector_Intrinsics_vec256 *wv = acc.fst;
     Lib_IntVector_Intrinsics_vec256 *hash = acc.snd;
     uint32_t nb = data1_len / 128U;
@@ -967,8 +1000,7 @@ Hacl_Hash_Blake2b_Simd256_update(
     if (!(sz1 == 0U))
     {
       uint64_t prevlen = total_len1 - (uint64_t)sz1;
-      K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_
-      acc = block_state1.thd;
+      K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_ acc = block_state1.f3;
       Lib_IntVector_Intrinsics_vec256 *wv = acc.fst;
       Lib_IntVector_Intrinsics_vec256 *hash = acc.snd;
       uint32_t nb = 1U;
@@ -994,7 +1026,7 @@ Hacl_Hash_Blake2b_Simd256_update(
     uint32_t data2_len = chunk_len - diff - data1_len;
     uint8_t *data1 = chunk2;
     uint8_t *data2 = chunk2 + data1_len;
-    K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_ acc = block_state1.thd;
+    K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_ acc = block_state1.f3;
     Lib_IntVector_Intrinsics_vec256 *wv = acc.fst;
     Lib_IntVector_Intrinsics_vec256 *hash = acc.snd;
     uint32_t nb = data1_len / 128U;
@@ -1020,16 +1052,25 @@ Hacl_Hash_Blake2b_Simd256_update(
 }
 
 /**
-  Finish function when there is no key
+ Digest function. This function expects the `output` array to hold
+at least `digest_length` bytes, where `digest_length` was determined by your
+choice of `malloc` function. Concretely, if you used `malloc` or
+`malloc_with_key`, then the expected length is 256 for S, or 64 for B (default
+digest length). If you used `malloc_with_params_and_key`, then the expected
+length is whatever you chose for the `digest_length` field of your parameters.
+For convenience, this function returns `digest_length`. When in doubt, callers
+can pass an array of size HACL_BLAKE2B_256_OUT_BYTES, then use the return value
+to see how many bytes were actually written.
 */
-void
-Hacl_Hash_Blake2b_Simd256_digest(Hacl_Hash_Blake2b_Simd256_state_t *state, uint8_t *output)
+uint8_t Hacl_Hash_Blake2b_Simd256_digest(Hacl_Hash_Blake2b_Simd256_state_t *s, uint8_t *dst)
 {
-  Hacl_Hash_Blake2b_Simd256_block_state_t block_state0 = (*state).block_state;
-  uint8_t nn = block_state0.snd;
-  uint8_t kk1 = block_state0.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
-  Hacl_Hash_Blake2b_Simd256_state_t scrut = *state;
+  Hacl_Hash_Blake2b_Simd256_block_state_t block_state0 = (*s).block_state;
+  bool last_node0 = block_state0.thd;
+  uint8_t nn0 = block_state0.snd;
+  uint8_t kk0 = block_state0.fst;
+  Hacl_Hash_Blake2b_index
+  i1 = { .key_length = kk0, .digest_length = nn0, .last_node = last_node0 };
+  Hacl_Hash_Blake2b_Simd256_state_t scrut = *s;
   Hacl_Hash_Blake2b_Simd256_block_state_t block_state = scrut.block_state;
   uint8_t *buf_ = scrut.buf;
   uint64_t total_len = scrut.total_len;
@@ -1047,9 +1088,14 @@ Hacl_Hash_Blake2b_Simd256_digest(Hacl_Hash_Blake2b_Simd256_state_t *state, uint8
   KRML_PRE_ALIGN(32) Lib_IntVector_Intrinsics_vec256 b[4U] KRML_POST_ALIGN(32) = { 0U };
   Hacl_Hash_Blake2b_Simd256_block_state_t
   tmp_block_state =
-    { .fst = i.key_length, .snd = i.digest_length, .thd = { .fst = wv0, .snd = b } };
-  Lib_IntVector_Intrinsics_vec256 *src_b = block_state.thd.snd;
-  Lib_IntVector_Intrinsics_vec256 *dst_b = tmp_block_state.thd.snd;
+    {
+      .fst = i1.key_length,
+      .snd = i1.digest_length,
+      .thd = i1.last_node,
+      .f3 = { .fst = wv0, .snd = b }
+    };
+  Lib_IntVector_Intrinsics_vec256 *src_b = block_state.f3.snd;
+  Lib_IntVector_Intrinsics_vec256 *dst_b = tmp_block_state.f3.snd;
   memcpy(dst_b, src_b, 4U * sizeof (Lib_IntVector_Intrinsics_vec256));
   uint64_t prev_len = total_len - (uint64_t)r;
   uint32_t ite;
@@ -1064,7 +1110,7 @@ Hacl_Hash_Blake2b_Simd256_digest(Hacl_Hash_Blake2b_Simd256_state_t *state, uint8
   uint8_t *buf_last = buf_1 + r - ite;
   uint8_t *buf_multi = buf_1;
   K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_
-  acc0 = tmp_block_state.thd;
+  acc0 = tmp_block_state.f3;
   Lib_IntVector_Intrinsics_vec256 *wv1 = acc0.fst;
   Lib_IntVector_Intrinsics_vec256 *hash0 = acc0.snd;
   uint32_t nb = 0U;
@@ -1076,17 +1122,35 @@ Hacl_Hash_Blake2b_Simd256_digest(Hacl_Hash_Blake2b_Simd256_state_t *state, uint8
     nb);
   uint64_t prev_len_last = total_len - (uint64_t)r;
   K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_
-  acc = tmp_block_state.thd;
+  acc = tmp_block_state.f3;
+  bool last_node1 = tmp_block_state.thd;
   Lib_IntVector_Intrinsics_vec256 *wv = acc.fst;
   Lib_IntVector_Intrinsics_vec256 *hash = acc.snd;
   Hacl_Hash_Blake2b_Simd256_update_last(r,
     wv,
     hash,
+    last_node1,
     FStar_UInt128_uint64_to_uint128(prev_len_last),
     r,
     buf_last);
-  uint8_t nn0 = tmp_block_state.snd;
-  Hacl_Hash_Blake2b_Simd256_finish((uint32_t)nn0, output, tmp_block_state.thd.snd);
+  uint8_t nn1 = tmp_block_state.snd;
+  Hacl_Hash_Blake2b_Simd256_finish((uint32_t)nn1, dst, tmp_block_state.f3.snd);
+  Hacl_Hash_Blake2b_Simd256_block_state_t block_state1 = (*s).block_state;
+  bool last_node = block_state1.thd;
+  uint8_t nn = block_state1.snd;
+  uint8_t kk = block_state1.fst;
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk, .digest_length = nn, .last_node = last_node }).digest_length;
+}
+
+Hacl_Hash_Blake2b_index Hacl_Hash_Blake2b_Simd256_info(Hacl_Hash_Blake2b_Simd256_state_t *s)
+{
+  Hacl_Hash_Blake2b_Simd256_block_state_t block_state = (*s).block_state;
+  bool last_node = block_state.thd;
+  uint8_t nn = block_state.snd;
+  uint8_t kk = block_state.fst;
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk, .digest_length = nn, .last_node = last_node });
 }
 
 /**
@@ -1097,8 +1161,8 @@ void Hacl_Hash_Blake2b_Simd256_free(Hacl_Hash_Blake2b_Simd256_state_t *state)
   Hacl_Hash_Blake2b_Simd256_state_t scrut = *state;
   uint8_t *buf = scrut.buf;
   Hacl_Hash_Blake2b_Simd256_block_state_t block_state = scrut.block_state;
-  Lib_IntVector_Intrinsics_vec256 *b = block_state.thd.snd;
-  Lib_IntVector_Intrinsics_vec256 *wv = block_state.thd.fst;
+  Lib_IntVector_Intrinsics_vec256 *b = block_state.f3.snd;
+  Lib_IntVector_Intrinsics_vec256 *wv = block_state.f3.fst;
   KRML_ALIGNED_FREE(wv);
   KRML_ALIGNED_FREE(b);
   KRML_HOST_FREE(buf);
@@ -1106,7 +1170,7 @@ void Hacl_Hash_Blake2b_Simd256_free(Hacl_Hash_Blake2b_Simd256_state_t *state)
 }
 
 /**
-  Copying. The key length (or absence thereof) must match between source and destination.
+  Copying. This preserves all parameters.
 */
 Hacl_Hash_Blake2b_Simd256_state_t
 *Hacl_Hash_Blake2b_Simd256_copy(Hacl_Hash_Blake2b_Simd256_state_t *state)
@@ -1115,9 +1179,10 @@ Hacl_Hash_Blake2b_Simd256_state_t
   Hacl_Hash_Blake2b_Simd256_block_state_t block_state0 = scrut.block_state;
   uint8_t *buf0 = scrut.buf;
   uint64_t total_len0 = scrut.total_len;
+  bool last_node = block_state0.thd;
   uint8_t nn = block_state0.snd;
   uint8_t kk1 = block_state0.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
+  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC(128U, sizeof (uint8_t));
   memcpy(buf, buf0, 128U * sizeof (uint8_t));
   Lib_IntVector_Intrinsics_vec256
@@ -1131,9 +1196,15 @@ Hacl_Hash_Blake2b_Simd256_state_t
       sizeof (Lib_IntVector_Intrinsics_vec256) * 4U);
   memset(b, 0U, 4U * sizeof (Lib_IntVector_Intrinsics_vec256));
   Hacl_Hash_Blake2b_Simd256_block_state_t
-  block_state = { .fst = i.key_length, .snd = i.digest_length, .thd = { .fst = wv, .snd = b } };
-  Lib_IntVector_Intrinsics_vec256 *src_b = block_state0.thd.snd;
-  Lib_IntVector_Intrinsics_vec256 *dst_b = block_state.thd.snd;
+  block_state =
+    {
+      .fst = i.key_length,
+      .snd = i.digest_length,
+      .thd = i.last_node,
+      .f3 = { .fst = wv, .snd = b }
+    };
+  Lib_IntVector_Intrinsics_vec256 *src_b = block_state0.f3.snd;
+  Lib_IntVector_Intrinsics_vec256 *dst_b = block_state.f3.snd;
   memcpy(dst_b, src_b, 4U * sizeof (Lib_IntVector_Intrinsics_vec256));
   Hacl_Hash_Blake2b_Simd256_state_t
   s = { .block_state = block_state, .buf = buf, .total_len = total_len0 };
@@ -1175,8 +1246,14 @@ Hacl_Hash_Blake2b_Simd256_hash_with_key(
   Lib_Memzero0_memzero(b, 4U, Lib_IntVector_Intrinsics_vec256, void *);
 }
 
+/**
+Write the BLAKE2b digest of message `input` using key `key` and
+parameters `params` into `output`. The `key` array must be of length
+`params.key_length`. The `output` array must be of length
+`params.digest_length`.
+*/
 void
-Hacl_Hash_Blake2b_Simd256_hash_with_key_and_paramas(
+Hacl_Hash_Blake2b_Simd256_hash_with_key_and_params(
   uint8_t *output,
   uint8_t *input,
   uint32_t input_len,
diff --git a/src/Hacl_Hash_Blake2s.c b/src/Hacl_Hash_Blake2s.c
index 6e19d83d..167f38fb 100644
--- a/src/Hacl_Hash_Blake2s.c
+++ b/src/Hacl_Hash_Blake2s.c
@@ -30,7 +30,14 @@
 #include "lib_memzero0.h"
 
 static inline void
-update_block(uint32_t *wv, uint32_t *hash, bool flag, uint64_t totlen, uint8_t *d)
+update_block(
+  uint32_t *wv,
+  uint32_t *hash,
+  bool flag,
+  bool last_node,
+  uint64_t totlen,
+  uint8_t *d
+)
 {
   uint32_t m_w[16U] = { 0U };
   KRML_MAYBE_FOR16(i,
@@ -53,7 +60,15 @@ update_block(uint32_t *wv, uint32_t *hash, bool flag, uint64_t totlen, uint8_t *
   {
     wv_14 = 0U;
   }
-  uint32_t wv_15 = 0U;
+  uint32_t wv_15;
+  if (last_node)
+  {
+    wv_15 = 0xFFFFFFFFU;
+  }
+  else
+  {
+    wv_15 = 0U;
+  }
   mask[0U] = (uint32_t)totlen;
   mask[1U] = (uint32_t)(totlen >> 32U);
   mask[2U] = wv_14;
@@ -642,11 +657,11 @@ static void update_key(uint32_t *wv, uint32_t *hash, uint32_t kk, uint8_t *k, ui
   memcpy(b, k, kk * sizeof (uint8_t));
   if (ll == 0U)
   {
-    update_block(wv, hash, true, lb, b);
+    update_block(wv, hash, true, false, lb, b);
   }
   else
   {
-    update_block(wv, hash, false, lb, b);
+    update_block(wv, hash, false, false, lb, b);
   }
   Lib_Memzero0_memzero(b, 64U, uint8_t, void *);
 }
@@ -666,7 +681,7 @@ Hacl_Hash_Blake2s_update_multi(
   {
     uint64_t totlen = prev + (uint64_t)((i + 1U) * 64U);
     uint8_t *b = blocks + i * 64U;
-    update_block(wv, hash, false, totlen, b);
+    update_block(wv, hash, false, false, totlen, b);
   }
 }
 
@@ -675,6 +690,7 @@ Hacl_Hash_Blake2s_update_last(
   uint32_t len,
   uint32_t *wv,
   uint32_t *hash,
+  bool last_node,
   uint64_t prev,
   uint32_t rem,
   uint8_t *d
@@ -684,7 +700,7 @@ Hacl_Hash_Blake2s_update_last(
   uint8_t *last = d + len - rem;
   memcpy(b, last, rem * sizeof (uint8_t));
   uint64_t totlen = prev + (uint64_t)len;
-  update_block(wv, hash, true, totlen, b);
+  update_block(wv, hash, true, last_node, totlen, b);
   Lib_Memzero0_memzero(b, 64U, uint8_t, void *);
 }
 
@@ -712,7 +728,7 @@ update_blocks(uint32_t len, uint32_t *wv, uint32_t *hash, uint64_t prev, uint8_t
     rem = rem0;
   }
   Hacl_Hash_Blake2s_update_multi(len, wv, hash, prev, blocks, nb);
-  Hacl_Hash_Blake2s_update_last(len, wv, hash, prev, rem, blocks);
+  Hacl_Hash_Blake2s_update_last(len, wv, hash, false, prev, rem, blocks);
 }
 
 static inline void
@@ -747,16 +763,19 @@ void Hacl_Hash_Blake2s_finish(uint32_t nn, uint8_t *output, uint32_t *hash)
 }
 
 static Hacl_Hash_Blake2s_state_t
-*malloc_raw(
-  Hacl_Hash_Blake2b_index kk,
-  K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_ key
-)
+*malloc_raw(Hacl_Hash_Blake2b_index kk, Hacl_Hash_Blake2b_params_and_key key)
 {
   uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC(64U, sizeof (uint8_t));
   uint32_t *wv = (uint32_t *)KRML_HOST_CALLOC(16U, sizeof (uint32_t));
   uint32_t *b = (uint32_t *)KRML_HOST_CALLOC(16U, sizeof (uint32_t));
   Hacl_Hash_Blake2s_block_state_t
-  block_state = { .fst = kk.key_length, .snd = kk.digest_length, .thd = { .fst = wv, .snd = b } };
+  block_state =
+    {
+      .fst = kk.key_length,
+      .snd = kk.digest_length,
+      .thd = kk.last_node,
+      .f3 = { .fst = wv, .snd = b }
+    };
   uint8_t kk10 = kk.key_length;
   uint32_t ite;
   if (kk10 != 0U)
@@ -775,7 +794,8 @@ static Hacl_Hash_Blake2s_state_t
   Hacl_Hash_Blake2b_blake2_params *p1 = key.fst;
   uint8_t kk1 = p1->key_length;
   uint8_t nn = p1->digest_length;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
+  bool last_node = block_state.thd;
+  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint32_t kk2 = (uint32_t)i.key_length;
   uint8_t *k_1 = key.snd;
   if (!(kk2 == 0U))
@@ -785,38 +805,55 @@ static Hacl_Hash_Blake2s_state_t
     memcpy(buf, k_1, kk2 * sizeof (uint8_t));
   }
   Hacl_Hash_Blake2b_blake2_params pv = p1[0U];
-  init_with_params(block_state.thd.snd, pv);
+  init_with_params(block_state.f3.snd, pv);
   return p;
 }
 
 /**
- State allocation function when there are parameters and a key. The
-length of the key k MUST match the value of the field key_length in the
-parameters. Furthermore, there is a static (not dynamically checked) requirement
-that key_length does not exceed max_key (32 for S, 64 for B).)
+ General-purpose allocation function that gives control over all
+Blake2 parameters, including the key. Further resettings of the state SHALL be
+done with `reset_with_params_and_key`, and SHALL feature the exact same values
+for the `key_length` and `digest_length` fields as passed here. In other words,
+once you commit to a digest and key length, the only way to change these
+parameters is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The length of the key k MUST match the value of the field key_length in the
+  parameters.
+- The key_length must not exceed 32 for S, 64 for B.
+- The digest_length must not exceed 32 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2s_state_t
-*Hacl_Hash_Blake2s_malloc_with_params_and_key(Hacl_Hash_Blake2b_blake2_params *p, uint8_t *k)
+*Hacl_Hash_Blake2s_malloc_with_params_and_key(
+  Hacl_Hash_Blake2b_blake2_params *p,
+  bool last_node,
+  uint8_t *k
+)
 {
   Hacl_Hash_Blake2b_blake2_params pv = p[0U];
   Hacl_Hash_Blake2b_index
-  i1 = { .key_length = pv.key_length, .digest_length = pv.digest_length };
-  return
-    malloc_raw(i1,
-      ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = p, .snd = k }));
+  i1 = { .key_length = pv.key_length, .digest_length = pv.digest_length, .last_node = last_node };
+  return malloc_raw(i1, ((Hacl_Hash_Blake2b_params_and_key){ .fst = p, .snd = k }));
 }
 
 /**
- State allocation function when there is just a custom key. All
-other parameters are set to their respective default values, meaning the output
-length is the maximum allowed output (32 for S, 64 for B).
+ Specialized allocation function that picks default values for all
+parameters, except for the key_length. Further resettings of the state SHALL be
+done with `reset_with_key`, and SHALL feature the exact same key length `kk` as
+passed here. In other words, once you commit to a key length, the only way to
+change this parameter is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The key_length must not exceed 32 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_malloc_with_key(uint8_t *k, uint8_t kk)
 {
   uint8_t nn = 32U;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk, .digest_length = nn };
-  uint8_t *salt = (uint8_t *)KRML_HOST_CALLOC(8U, sizeof (uint8_t));
-  uint8_t *personal = (uint8_t *)KRML_HOST_CALLOC(8U, sizeof (uint8_t));
+  Hacl_Hash_Blake2b_index i = { .key_length = kk, .digest_length = nn, .last_node = false };
+  uint8_t salt[8U] = { 0U };
+  uint8_t personal[8U] = { 0U };
   Hacl_Hash_Blake2b_blake2_params
   p =
     {
@@ -824,20 +861,15 @@ Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_malloc_with_key(uint8_t *k, uint8_t
       .leaf_length = 0U, .node_offset = 0ULL, .node_depth = 0U, .inner_length = 0U, .salt = salt,
       .personal = personal
     };
-  Hacl_Hash_Blake2b_blake2_params
-  *p0 =
-    (Hacl_Hash_Blake2b_blake2_params *)KRML_HOST_MALLOC(sizeof (Hacl_Hash_Blake2b_blake2_params));
-  p0[0U] = p;
-  Hacl_Hash_Blake2s_state_t *s = Hacl_Hash_Blake2s_malloc_with_params_and_key(p0, k);
-  Hacl_Hash_Blake2b_blake2_params p1 = p0[0U];
-  KRML_HOST_FREE(p1.salt);
-  KRML_HOST_FREE(p1.personal);
-  KRML_HOST_FREE(p0);
+  Hacl_Hash_Blake2b_blake2_params p0 = p;
+  Hacl_Hash_Blake2s_state_t *s = Hacl_Hash_Blake2s_malloc_with_params_and_key(&p0, false, k);
   return s;
 }
 
 /**
-  State allocation function when there is no key
+ Specialized allocation function that picks default values for all
+parameters, and has no key. Effectively, this is what you want if you intend to
+use Blake2 as a hash function. Further resettings of the state SHALL be done with `reset`.
 */
 Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_malloc(void)
 {
@@ -847,28 +879,30 @@ Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_malloc(void)
 static Hacl_Hash_Blake2b_index index_of_state(Hacl_Hash_Blake2s_state_t *s)
 {
   Hacl_Hash_Blake2s_block_state_t block_state = (*s).block_state;
+  bool last_node = block_state.thd;
   uint8_t nn = block_state.snd;
   uint8_t kk1 = block_state.fst;
-  return ((Hacl_Hash_Blake2b_index){ .key_length = kk1, .digest_length = nn });
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk1, .digest_length = nn, .last_node = last_node });
 }
 
-static void
-reset_raw(
-  Hacl_Hash_Blake2s_state_t *state,
-  K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_ key
-)
+static void reset_raw(Hacl_Hash_Blake2s_state_t *state, Hacl_Hash_Blake2b_params_and_key key)
 {
   Hacl_Hash_Blake2s_state_t scrut = *state;
   uint8_t *buf = scrut.buf;
   Hacl_Hash_Blake2s_block_state_t block_state = scrut.block_state;
+  bool last_node0 = block_state.thd;
   uint8_t nn0 = block_state.snd;
   uint8_t kk10 = block_state.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk10, .digest_length = nn0 };
+  Hacl_Hash_Blake2b_index
+  i = { .key_length = kk10, .digest_length = nn0, .last_node = last_node0 };
   KRML_MAYBE_UNUSED_VAR(i);
   Hacl_Hash_Blake2b_blake2_params *p = key.fst;
   uint8_t kk1 = p->key_length;
   uint8_t nn = p->digest_length;
-  Hacl_Hash_Blake2b_index i1 = { .key_length = kk1, .digest_length = nn };
+  bool last_node = block_state.thd;
+  Hacl_Hash_Blake2b_index
+  i1 = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint32_t kk2 = (uint32_t)i1.key_length;
   uint8_t *k_1 = key.snd;
   if (!(kk2 == 0U))
@@ -878,7 +912,7 @@ reset_raw(
     memcpy(buf, k_1, kk2 * sizeof (uint8_t));
   }
   Hacl_Hash_Blake2b_blake2_params pv = p[0U];
-  init_with_params(block_state.thd.snd, pv);
+  init_with_params(block_state.f3.snd, pv);
   uint8_t kk11 = i.key_length;
   uint32_t ite;
   if (kk11 != 0U)
@@ -895,9 +929,11 @@ reset_raw(
 }
 
 /**
- Re-initialization function. The reinitialization API is tricky --
-you MUST reuse the same original parameters for digest (output) length and key
-length.
+ General-purpose re-initialization function with parameters and
+key. You cannot change digest_length, key_length, or last_node, meaning those values in
+the parameters object must be the same as originally decided via one of the
+malloc functions. All other values of the parameter can be changed. The behavior
+is unspecified if you violate this precondition.
 */
 void
 Hacl_Hash_Blake2s_reset_with_key_and_params(
@@ -907,14 +943,15 @@ Hacl_Hash_Blake2s_reset_with_key_and_params(
 )
 {
   index_of_state(s);
-  reset_raw(s, ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = p, .snd = k }));
+  reset_raw(s, ((Hacl_Hash_Blake2b_params_and_key){ .fst = p, .snd = k }));
 }
 
 /**
- Re-initialization function when there is a key. Note that the key
-size is not allowed to change, which is why this function does not take a key
-length -- the key has to be same key size that was originally passed to
-`malloc_with_key`
+ Specialized-purpose re-initialization function with no parameters,
+and a key. The key length must be the same as originally decided via your choice
+of malloc function. All other parameters are reset to their default values. The
+original call to malloc MUST have set digest_length to the default value. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2s_reset_with_key(Hacl_Hash_Blake2s_state_t *s, uint8_t *k)
 {
@@ -929,11 +966,16 @@ void Hacl_Hash_Blake2s_reset_with_key(Hacl_Hash_Blake2s_state_t *s, uint8_t *k)
       .personal = personal
     };
   Hacl_Hash_Blake2b_blake2_params p0 = p;
-  reset_raw(s, ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = &p0, .snd = k }));
+  reset_raw(s, ((Hacl_Hash_Blake2b_params_and_key){ .fst = &p0, .snd = k }));
 }
 
 /**
-  Re-initialization function when there is no key
+ Specialized-purpose re-initialization function with no parameters
+and no key. This is what you want if you intend to use Blake2 as a hash
+function. The key length and digest length must have been set to their
+respective default values via your choice of malloc function (always true if you
+used `malloc`). All other parameters are reset to their default values. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2s_reset(Hacl_Hash_Blake2s_state_t *s)
 {
@@ -941,7 +983,7 @@ void Hacl_Hash_Blake2s_reset(Hacl_Hash_Blake2s_state_t *s)
 }
 
 /**
-  Update function when there is no key; 0 = success, 1 = max length exceeded
+  Update function; 0 = success, 1 = max length exceeded
 */
 Hacl_Streaming_Types_error_code
 Hacl_Hash_Blake2s_update(Hacl_Hash_Blake2s_state_t *state, uint8_t *chunk, uint32_t chunk_len)
@@ -1007,7 +1049,7 @@ Hacl_Hash_Blake2s_update(Hacl_Hash_Blake2s_state_t *state, uint8_t *chunk, uint3
     if (!(sz1 == 0U))
     {
       uint64_t prevlen = total_len1 - (uint64_t)sz1;
-      K____uint32_t___uint32_t_ acc = block_state1.thd;
+      K____uint32_t___uint32_t_ acc = block_state1.f3;
       uint32_t *wv = acc.fst;
       uint32_t *hash = acc.snd;
       uint32_t nb = 1U;
@@ -1027,7 +1069,7 @@ Hacl_Hash_Blake2s_update(Hacl_Hash_Blake2s_state_t *state, uint8_t *chunk, uint3
     uint32_t data2_len = chunk_len - data1_len;
     uint8_t *data1 = chunk;
     uint8_t *data2 = chunk + data1_len;
-    K____uint32_t___uint32_t_ acc = block_state1.thd;
+    K____uint32_t___uint32_t_ acc = block_state1.f3;
     uint32_t *wv = acc.fst;
     uint32_t *hash = acc.snd;
     uint32_t nb = data1_len / 64U;
@@ -1090,7 +1132,7 @@ Hacl_Hash_Blake2s_update(Hacl_Hash_Blake2s_state_t *state, uint8_t *chunk, uint3
     if (!(sz1 == 0U))
     {
       uint64_t prevlen = total_len1 - (uint64_t)sz1;
-      K____uint32_t___uint32_t_ acc = block_state1.thd;
+      K____uint32_t___uint32_t_ acc = block_state1.f3;
       uint32_t *wv = acc.fst;
       uint32_t *hash = acc.snd;
       uint32_t nb = 1U;
@@ -1111,7 +1153,7 @@ Hacl_Hash_Blake2s_update(Hacl_Hash_Blake2s_state_t *state, uint8_t *chunk, uint3
     uint32_t data2_len = chunk_len - diff - data1_len;
     uint8_t *data1 = chunk2;
     uint8_t *data2 = chunk2 + data1_len;
-    K____uint32_t___uint32_t_ acc = block_state1.thd;
+    K____uint32_t___uint32_t_ acc = block_state1.f3;
     uint32_t *wv = acc.fst;
     uint32_t *hash = acc.snd;
     uint32_t nb = data1_len / 64U;
@@ -1132,15 +1174,25 @@ Hacl_Hash_Blake2s_update(Hacl_Hash_Blake2s_state_t *state, uint8_t *chunk, uint3
 }
 
 /**
-  Finish function when there is no key
+ Digest function. This function expects the `output` array to hold
+at least `digest_length` bytes, where `digest_length` was determined by your
+choice of `malloc` function. Concretely, if you used `malloc` or
+`malloc_with_key`, then the expected length is 32 for S, or 64 for B (default
+digest length). If you used `malloc_with_params_and_key`, then the expected
+length is whatever you chose for the `digest_length` field of your parameters.
+For convenience, this function returns `digest_length`. When in doubt, callers
+can pass an array of size HACL_BLAKE2S_32_OUT_BYTES, then use the return value
+to see how many bytes were actually written.
 */
-void Hacl_Hash_Blake2s_digest(Hacl_Hash_Blake2s_state_t *state, uint8_t *output)
+uint8_t Hacl_Hash_Blake2s_digest(Hacl_Hash_Blake2s_state_t *s, uint8_t *dst)
 {
-  Hacl_Hash_Blake2s_block_state_t block_state0 = (*state).block_state;
-  uint8_t nn = block_state0.snd;
-  uint8_t kk1 = block_state0.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
-  Hacl_Hash_Blake2s_state_t scrut = *state;
+  Hacl_Hash_Blake2s_block_state_t block_state0 = (*s).block_state;
+  bool last_node0 = block_state0.thd;
+  uint8_t nn0 = block_state0.snd;
+  uint8_t kk0 = block_state0.fst;
+  Hacl_Hash_Blake2b_index
+  i1 = { .key_length = kk0, .digest_length = nn0, .last_node = last_node0 };
+  Hacl_Hash_Blake2s_state_t scrut = *s;
   Hacl_Hash_Blake2s_block_state_t block_state = scrut.block_state;
   uint8_t *buf_ = scrut.buf;
   uint64_t total_len = scrut.total_len;
@@ -1158,9 +1210,14 @@ void Hacl_Hash_Blake2s_digest(Hacl_Hash_Blake2s_state_t *state, uint8_t *output)
   uint32_t b[16U] = { 0U };
   Hacl_Hash_Blake2s_block_state_t
   tmp_block_state =
-    { .fst = i.key_length, .snd = i.digest_length, .thd = { .fst = wv0, .snd = b } };
-  uint32_t *src_b = block_state.thd.snd;
-  uint32_t *dst_b = tmp_block_state.thd.snd;
+    {
+      .fst = i1.key_length,
+      .snd = i1.digest_length,
+      .thd = i1.last_node,
+      .f3 = { .fst = wv0, .snd = b }
+    };
+  uint32_t *src_b = block_state.f3.snd;
+  uint32_t *dst_b = tmp_block_state.f3.snd;
   memcpy(dst_b, src_b, 16U * sizeof (uint32_t));
   uint64_t prev_len = total_len - (uint64_t)r;
   uint32_t ite;
@@ -1174,18 +1231,35 @@ void Hacl_Hash_Blake2s_digest(Hacl_Hash_Blake2s_state_t *state, uint8_t *output)
   }
   uint8_t *buf_last = buf_1 + r - ite;
   uint8_t *buf_multi = buf_1;
-  K____uint32_t___uint32_t_ acc0 = tmp_block_state.thd;
+  K____uint32_t___uint32_t_ acc0 = tmp_block_state.f3;
   uint32_t *wv1 = acc0.fst;
   uint32_t *hash0 = acc0.snd;
   uint32_t nb = 0U;
   Hacl_Hash_Blake2s_update_multi(0U, wv1, hash0, prev_len, buf_multi, nb);
   uint64_t prev_len_last = total_len - (uint64_t)r;
-  K____uint32_t___uint32_t_ acc = tmp_block_state.thd;
+  K____uint32_t___uint32_t_ acc = tmp_block_state.f3;
+  bool last_node1 = tmp_block_state.thd;
   uint32_t *wv = acc.fst;
   uint32_t *hash = acc.snd;
-  Hacl_Hash_Blake2s_update_last(r, wv, hash, prev_len_last, r, buf_last);
-  uint8_t nn0 = tmp_block_state.snd;
-  Hacl_Hash_Blake2s_finish((uint32_t)nn0, output, tmp_block_state.thd.snd);
+  Hacl_Hash_Blake2s_update_last(r, wv, hash, last_node1, prev_len_last, r, buf_last);
+  uint8_t nn1 = tmp_block_state.snd;
+  Hacl_Hash_Blake2s_finish((uint32_t)nn1, dst, tmp_block_state.f3.snd);
+  Hacl_Hash_Blake2s_block_state_t block_state1 = (*s).block_state;
+  bool last_node = block_state1.thd;
+  uint8_t nn = block_state1.snd;
+  uint8_t kk = block_state1.fst;
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk, .digest_length = nn, .last_node = last_node }).digest_length;
+}
+
+Hacl_Hash_Blake2b_index Hacl_Hash_Blake2s_info(Hacl_Hash_Blake2s_state_t *s)
+{
+  Hacl_Hash_Blake2s_block_state_t block_state = (*s).block_state;
+  bool last_node = block_state.thd;
+  uint8_t nn = block_state.snd;
+  uint8_t kk = block_state.fst;
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk, .digest_length = nn, .last_node = last_node });
 }
 
 /**
@@ -1196,8 +1270,8 @@ void Hacl_Hash_Blake2s_free(Hacl_Hash_Blake2s_state_t *state)
   Hacl_Hash_Blake2s_state_t scrut = *state;
   uint8_t *buf = scrut.buf;
   Hacl_Hash_Blake2s_block_state_t block_state = scrut.block_state;
-  uint32_t *b = block_state.thd.snd;
-  uint32_t *wv = block_state.thd.fst;
+  uint32_t *b = block_state.f3.snd;
+  uint32_t *wv = block_state.f3.fst;
   KRML_HOST_FREE(wv);
   KRML_HOST_FREE(b);
   KRML_HOST_FREE(buf);
@@ -1205,7 +1279,7 @@ void Hacl_Hash_Blake2s_free(Hacl_Hash_Blake2s_state_t *state)
 }
 
 /**
-  Copying. The key length (or absence thereof) must match between source and destination.
+  Copying. This preserves all parameters.
 */
 Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_copy(Hacl_Hash_Blake2s_state_t *state)
 {
@@ -1213,17 +1287,24 @@ Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_copy(Hacl_Hash_Blake2s_state_t *sta
   Hacl_Hash_Blake2s_block_state_t block_state0 = scrut.block_state;
   uint8_t *buf0 = scrut.buf;
   uint64_t total_len0 = scrut.total_len;
+  bool last_node = block_state0.thd;
   uint8_t nn = block_state0.snd;
   uint8_t kk1 = block_state0.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
+  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC(64U, sizeof (uint8_t));
   memcpy(buf, buf0, 64U * sizeof (uint8_t));
   uint32_t *wv = (uint32_t *)KRML_HOST_CALLOC(16U, sizeof (uint32_t));
   uint32_t *b = (uint32_t *)KRML_HOST_CALLOC(16U, sizeof (uint32_t));
   Hacl_Hash_Blake2s_block_state_t
-  block_state = { .fst = i.key_length, .snd = i.digest_length, .thd = { .fst = wv, .snd = b } };
-  uint32_t *src_b = block_state0.thd.snd;
-  uint32_t *dst_b = block_state.thd.snd;
+  block_state =
+    {
+      .fst = i.key_length,
+      .snd = i.digest_length,
+      .thd = i.last_node,
+      .f3 = { .fst = wv, .snd = b }
+    };
+  uint32_t *src_b = block_state0.f3.snd;
+  uint32_t *dst_b = block_state.f3.snd;
   memcpy(dst_b, src_b, 16U * sizeof (uint32_t));
   Hacl_Hash_Blake2s_state_t
   s = { .block_state = block_state, .buf = buf, .total_len = total_len0 };
@@ -1262,8 +1343,14 @@ Hacl_Hash_Blake2s_hash_with_key(
   Lib_Memzero0_memzero(b, 16U, uint32_t, void *);
 }
 
+/**
+Write the BLAKE2s digest of message `input` using key `key` and
+parameters `params` into `output`. The `key` array must be of length
+`params.key_length`. The `output` array must be of length
+`params.digest_length`.
+*/
 void
-Hacl_Hash_Blake2s_hash_with_key_and_paramas(
+Hacl_Hash_Blake2s_hash_with_key_and_params(
   uint8_t *output,
   uint8_t *input,
   uint32_t input_len,
diff --git a/src/Hacl_Hash_Blake2s_Simd128.c b/src/Hacl_Hash_Blake2s_Simd128.c
index c02da8fa..a85b18a4 100644
--- a/src/Hacl_Hash_Blake2s_Simd128.c
+++ b/src/Hacl_Hash_Blake2s_Simd128.c
@@ -34,6 +34,7 @@ update_block(
   Lib_IntVector_Intrinsics_vec128 *wv,
   Lib_IntVector_Intrinsics_vec128 *hash,
   bool flag,
+  bool last_node,
   uint64_t totlen,
   uint8_t *d
 )
@@ -59,7 +60,15 @@ update_block(
   {
     wv_14 = 0U;
   }
-  uint32_t wv_15 = 0U;
+  uint32_t wv_15;
+  if (last_node)
+  {
+    wv_15 = 0xFFFFFFFFU;
+  }
+  else
+  {
+    wv_15 = 0U;
+  }
   mask =
     Lib_IntVector_Intrinsics_vec128_load32s((uint32_t)totlen,
       (uint32_t)(totlen >> 32U),
@@ -366,11 +375,11 @@ update_key(
   memcpy(b, k, kk * sizeof (uint8_t));
   if (ll == 0U)
   {
-    update_block(wv, hash, true, lb, b);
+    update_block(wv, hash, true, false, lb, b);
   }
   else
   {
-    update_block(wv, hash, false, lb, b);
+    update_block(wv, hash, false, false, lb, b);
   }
   Lib_Memzero0_memzero(b, 64U, uint8_t, void *);
 }
@@ -390,7 +399,7 @@ Hacl_Hash_Blake2s_Simd128_update_multi(
   {
     uint64_t totlen = prev + (uint64_t)((i + 1U) * 64U);
     uint8_t *b = blocks + i * 64U;
-    update_block(wv, hash, false, totlen, b);
+    update_block(wv, hash, false, false, totlen, b);
   }
 }
 
@@ -399,6 +408,7 @@ Hacl_Hash_Blake2s_Simd128_update_last(
   uint32_t len,
   Lib_IntVector_Intrinsics_vec128 *wv,
   Lib_IntVector_Intrinsics_vec128 *hash,
+  bool last_node,
   uint64_t prev,
   uint32_t rem,
   uint8_t *d
@@ -408,7 +418,7 @@ Hacl_Hash_Blake2s_Simd128_update_last(
   uint8_t *last = d + len - rem;
   memcpy(b, last, rem * sizeof (uint8_t));
   uint64_t totlen = prev + (uint64_t)len;
-  update_block(wv, hash, true, totlen, b);
+  update_block(wv, hash, true, last_node, totlen, b);
   Lib_Memzero0_memzero(b, 64U, uint8_t, void *);
 }
 
@@ -442,7 +452,7 @@ update_blocks(
     rem = rem0;
   }
   Hacl_Hash_Blake2s_Simd128_update_multi(len, wv, hash, prev, blocks, nb);
-  Hacl_Hash_Blake2s_Simd128_update_last(len, wv, hash, prev, rem, blocks);
+  Hacl_Hash_Blake2s_Simd128_update_last(len, wv, hash, false, prev, rem, blocks);
 }
 
 static inline void
@@ -583,10 +593,7 @@ Lib_IntVector_Intrinsics_vec128 *Hacl_Hash_Blake2s_Simd128_malloc_with_key(void)
 }
 
 static Hacl_Hash_Blake2s_Simd128_state_t
-*malloc_raw(
-  Hacl_Hash_Blake2b_index kk,
-  K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_ key
-)
+*malloc_raw(Hacl_Hash_Blake2b_index kk, Hacl_Hash_Blake2b_params_and_key key)
 {
   uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC(64U, sizeof (uint8_t));
   Lib_IntVector_Intrinsics_vec128
@@ -600,7 +607,13 @@ static Hacl_Hash_Blake2s_Simd128_state_t
       sizeof (Lib_IntVector_Intrinsics_vec128) * 4U);
   memset(b, 0U, 4U * sizeof (Lib_IntVector_Intrinsics_vec128));
   Hacl_Hash_Blake2s_Simd128_block_state_t
-  block_state = { .fst = kk.key_length, .snd = kk.digest_length, .thd = { .fst = wv, .snd = b } };
+  block_state =
+    {
+      .fst = kk.key_length,
+      .snd = kk.digest_length,
+      .thd = kk.last_node,
+      .f3 = { .fst = wv, .snd = b }
+    };
   uint8_t kk10 = kk.key_length;
   uint32_t ite;
   if (kk10 != 0U)
@@ -622,7 +635,8 @@ static Hacl_Hash_Blake2s_Simd128_state_t
   Hacl_Hash_Blake2b_blake2_params *p1 = key.fst;
   uint8_t kk1 = p1->key_length;
   uint8_t nn = p1->digest_length;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
+  bool last_node = block_state.thd;
+  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint32_t kk2 = (uint32_t)i.key_length;
   uint8_t *k_1 = key.snd;
   if (!(kk2 == 0U))
@@ -632,42 +646,56 @@ static Hacl_Hash_Blake2s_Simd128_state_t
     memcpy(buf, k_1, kk2 * sizeof (uint8_t));
   }
   Hacl_Hash_Blake2b_blake2_params pv = p1[0U];
-  init_with_params(block_state.thd.snd, pv);
+  init_with_params(block_state.f3.snd, pv);
   return p;
 }
 
 /**
- State allocation function when there are parameters and a key. The
-length of the key k MUST match the value of the field key_length in the
-parameters. Furthermore, there is a static (not dynamically checked) requirement
-that key_length does not exceed max_key (128 for S, 64 for B).)
+ General-purpose allocation function that gives control over all
+Blake2 parameters, including the key. Further resettings of the state SHALL be
+done with `reset_with_params_and_key`, and SHALL feature the exact same values
+for the `key_length` and `digest_length` fields as passed here. In other words,
+once you commit to a digest and key length, the only way to change these
+parameters is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The length of the key k MUST match the value of the field key_length in the
+  parameters.
+- The key_length must not exceed 128 for S, 64 for B.
+- The digest_length must not exceed 128 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2s_Simd128_state_t
 *Hacl_Hash_Blake2s_Simd128_malloc_with_params_and_key(
   Hacl_Hash_Blake2b_blake2_params *p,
+  bool last_node,
   uint8_t *k
 )
 {
   Hacl_Hash_Blake2b_blake2_params pv = p[0U];
   Hacl_Hash_Blake2b_index
-  i1 = { .key_length = pv.key_length, .digest_length = pv.digest_length };
-  return
-    malloc_raw(i1,
-      ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = p, .snd = k }));
+  i1 = { .key_length = pv.key_length, .digest_length = pv.digest_length, .last_node = last_node };
+  return malloc_raw(i1, ((Hacl_Hash_Blake2b_params_and_key){ .fst = p, .snd = k }));
 }
 
 /**
- State allocation function when there is just a custom key. All
-other parameters are set to their respective default values, meaning the output
-length is the maximum allowed output (128 for S, 64 for B).
+ Specialized allocation function that picks default values for all
+parameters, except for the key_length. Further resettings of the state SHALL be
+done with `reset_with_key`, and SHALL feature the exact same key length `kk` as
+passed here. In other words, once you commit to a key length, the only way to
+change this parameter is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The key_length must not exceed 128 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2s_Simd128_state_t
 *Hacl_Hash_Blake2s_Simd128_malloc_with_key0(uint8_t *k, uint8_t kk)
 {
   uint8_t nn = 32U;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk, .digest_length = nn };
-  uint8_t *salt = (uint8_t *)KRML_HOST_CALLOC(8U, sizeof (uint8_t));
-  uint8_t *personal = (uint8_t *)KRML_HOST_CALLOC(8U, sizeof (uint8_t));
+  Hacl_Hash_Blake2b_index i = { .key_length = kk, .digest_length = nn, .last_node = false };
+  uint8_t salt[8U] = { 0U };
+  uint8_t personal[8U] = { 0U };
   Hacl_Hash_Blake2b_blake2_params
   p =
     {
@@ -675,21 +703,16 @@ Hacl_Hash_Blake2s_Simd128_state_t
       .leaf_length = 0U, .node_offset = 0ULL, .node_depth = 0U, .inner_length = 0U, .salt = salt,
       .personal = personal
     };
-  Hacl_Hash_Blake2b_blake2_params
-  *p0 =
-    (Hacl_Hash_Blake2b_blake2_params *)KRML_HOST_MALLOC(sizeof (Hacl_Hash_Blake2b_blake2_params));
-  p0[0U] = p;
+  Hacl_Hash_Blake2b_blake2_params p0 = p;
   Hacl_Hash_Blake2s_Simd128_state_t
-  *s = Hacl_Hash_Blake2s_Simd128_malloc_with_params_and_key(p0, k);
-  Hacl_Hash_Blake2b_blake2_params p1 = p0[0U];
-  KRML_HOST_FREE(p1.salt);
-  KRML_HOST_FREE(p1.personal);
-  KRML_HOST_FREE(p0);
+  *s = Hacl_Hash_Blake2s_Simd128_malloc_with_params_and_key(&p0, false, k);
   return s;
 }
 
 /**
-  State allocation function when there is no key
+ Specialized allocation function that picks default values for all
+parameters, and has no key. Effectively, this is what you want if you intend to
+use Blake2 as a hash function. Further resettings of the state SHALL be done with `reset`.
 */
 Hacl_Hash_Blake2s_Simd128_state_t *Hacl_Hash_Blake2s_Simd128_malloc(void)
 {
@@ -699,28 +722,31 @@ Hacl_Hash_Blake2s_Simd128_state_t *Hacl_Hash_Blake2s_Simd128_malloc(void)
 static Hacl_Hash_Blake2b_index index_of_state(Hacl_Hash_Blake2s_Simd128_state_t *s)
 {
   Hacl_Hash_Blake2s_Simd128_block_state_t block_state = (*s).block_state;
+  bool last_node = block_state.thd;
   uint8_t nn = block_state.snd;
   uint8_t kk1 = block_state.fst;
-  return ((Hacl_Hash_Blake2b_index){ .key_length = kk1, .digest_length = nn });
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk1, .digest_length = nn, .last_node = last_node });
 }
 
 static void
-reset_raw(
-  Hacl_Hash_Blake2s_Simd128_state_t *state,
-  K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_ key
-)
+reset_raw(Hacl_Hash_Blake2s_Simd128_state_t *state, Hacl_Hash_Blake2b_params_and_key key)
 {
   Hacl_Hash_Blake2s_Simd128_state_t scrut = *state;
   uint8_t *buf = scrut.buf;
   Hacl_Hash_Blake2s_Simd128_block_state_t block_state = scrut.block_state;
+  bool last_node0 = block_state.thd;
   uint8_t nn0 = block_state.snd;
   uint8_t kk10 = block_state.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk10, .digest_length = nn0 };
+  Hacl_Hash_Blake2b_index
+  i = { .key_length = kk10, .digest_length = nn0, .last_node = last_node0 };
   KRML_MAYBE_UNUSED_VAR(i);
   Hacl_Hash_Blake2b_blake2_params *p = key.fst;
   uint8_t kk1 = p->key_length;
   uint8_t nn = p->digest_length;
-  Hacl_Hash_Blake2b_index i1 = { .key_length = kk1, .digest_length = nn };
+  bool last_node = block_state.thd;
+  Hacl_Hash_Blake2b_index
+  i1 = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint32_t kk2 = (uint32_t)i1.key_length;
   uint8_t *k_1 = key.snd;
   if (!(kk2 == 0U))
@@ -730,7 +756,7 @@ reset_raw(
     memcpy(buf, k_1, kk2 * sizeof (uint8_t));
   }
   Hacl_Hash_Blake2b_blake2_params pv = p[0U];
-  init_with_params(block_state.thd.snd, pv);
+  init_with_params(block_state.f3.snd, pv);
   uint8_t kk11 = i.key_length;
   uint32_t ite;
   if (kk11 != 0U)
@@ -747,9 +773,11 @@ reset_raw(
 }
 
 /**
- Re-initialization function. The reinitialization API is tricky --
-you MUST reuse the same original parameters for digest (output) length and key
-length.
+ General-purpose re-initialization function with parameters and
+key. You cannot change digest_length, key_length, or last_node, meaning those values in
+the parameters object must be the same as originally decided via one of the
+malloc functions. All other values of the parameter can be changed. The behavior
+is unspecified if you violate this precondition.
 */
 void
 Hacl_Hash_Blake2s_Simd128_reset_with_key_and_params(
@@ -759,14 +787,15 @@ Hacl_Hash_Blake2s_Simd128_reset_with_key_and_params(
 )
 {
   index_of_state(s);
-  reset_raw(s, ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = p, .snd = k }));
+  reset_raw(s, ((Hacl_Hash_Blake2b_params_and_key){ .fst = p, .snd = k }));
 }
 
 /**
- Re-initialization function when there is a key. Note that the key
-size is not allowed to change, which is why this function does not take a key
-length -- the key has to be same key size that was originally passed to
-`malloc_with_key`
+ Specialized-purpose re-initialization function with no parameters,
+and a key. The key length must be the same as originally decided via your choice
+of malloc function. All other parameters are reset to their default values. The
+original call to malloc MUST have set digest_length to the default value. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2s_Simd128_reset_with_key(Hacl_Hash_Blake2s_Simd128_state_t *s, uint8_t *k)
 {
@@ -781,11 +810,16 @@ void Hacl_Hash_Blake2s_Simd128_reset_with_key(Hacl_Hash_Blake2s_Simd128_state_t
       .personal = personal
     };
   Hacl_Hash_Blake2b_blake2_params p0 = p;
-  reset_raw(s, ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = &p0, .snd = k }));
+  reset_raw(s, ((Hacl_Hash_Blake2b_params_and_key){ .fst = &p0, .snd = k }));
 }
 
 /**
-  Re-initialization function when there is no key
+ Specialized-purpose re-initialization function with no parameters
+and no key. This is what you want if you intend to use Blake2 as a hash
+function. The key length and digest length must have been set to their
+respective default values via your choice of malloc function (always true if you
+used `malloc`). All other parameters are reset to their default values. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2s_Simd128_reset(Hacl_Hash_Blake2s_Simd128_state_t *s)
 {
@@ -793,7 +827,7 @@ void Hacl_Hash_Blake2s_Simd128_reset(Hacl_Hash_Blake2s_Simd128_state_t *s)
 }
 
 /**
-  Update function when there is no key; 0 = success, 1 = max length exceeded
+  Update function; 0 = success, 1 = max length exceeded
 */
 Hacl_Streaming_Types_error_code
 Hacl_Hash_Blake2s_Simd128_update(
@@ -863,8 +897,7 @@ Hacl_Hash_Blake2s_Simd128_update(
     if (!(sz1 == 0U))
     {
       uint64_t prevlen = total_len1 - (uint64_t)sz1;
-      K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_
-      acc = block_state1.thd;
+      K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_ acc = block_state1.f3;
       Lib_IntVector_Intrinsics_vec128 *wv = acc.fst;
       Lib_IntVector_Intrinsics_vec128 *hash = acc.snd;
       uint32_t nb = 1U;
@@ -884,7 +917,7 @@ Hacl_Hash_Blake2s_Simd128_update(
     uint32_t data2_len = chunk_len - data1_len;
     uint8_t *data1 = chunk;
     uint8_t *data2 = chunk + data1_len;
-    K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_ acc = block_state1.thd;
+    K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_ acc = block_state1.f3;
     Lib_IntVector_Intrinsics_vec128 *wv = acc.fst;
     Lib_IntVector_Intrinsics_vec128 *hash = acc.snd;
     uint32_t nb = data1_len / 64U;
@@ -947,8 +980,7 @@ Hacl_Hash_Blake2s_Simd128_update(
     if (!(sz1 == 0U))
     {
       uint64_t prevlen = total_len1 - (uint64_t)sz1;
-      K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_
-      acc = block_state1.thd;
+      K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_ acc = block_state1.f3;
       Lib_IntVector_Intrinsics_vec128 *wv = acc.fst;
       Lib_IntVector_Intrinsics_vec128 *hash = acc.snd;
       uint32_t nb = 1U;
@@ -969,7 +1001,7 @@ Hacl_Hash_Blake2s_Simd128_update(
     uint32_t data2_len = chunk_len - diff - data1_len;
     uint8_t *data1 = chunk2;
     uint8_t *data2 = chunk2 + data1_len;
-    K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_ acc = block_state1.thd;
+    K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_ acc = block_state1.f3;
     Lib_IntVector_Intrinsics_vec128 *wv = acc.fst;
     Lib_IntVector_Intrinsics_vec128 *hash = acc.snd;
     uint32_t nb = data1_len / 64U;
@@ -990,16 +1022,25 @@ Hacl_Hash_Blake2s_Simd128_update(
 }
 
 /**
-  Finish function when there is no key
+ Digest function. This function expects the `output` array to hold
+at least `digest_length` bytes, where `digest_length` was determined by your
+choice of `malloc` function. Concretely, if you used `malloc` or
+`malloc_with_key`, then the expected length is 128 for S, or 64 for B (default
+digest length). If you used `malloc_with_params_and_key`, then the expected
+length is whatever you chose for the `digest_length` field of your parameters.
+For convenience, this function returns `digest_length`. When in doubt, callers
+can pass an array of size HACL_BLAKE2S_128_OUT_BYTES, then use the return value
+to see how many bytes were actually written.
 */
-void
-Hacl_Hash_Blake2s_Simd128_digest(Hacl_Hash_Blake2s_Simd128_state_t *state, uint8_t *output)
+uint8_t Hacl_Hash_Blake2s_Simd128_digest(Hacl_Hash_Blake2s_Simd128_state_t *s, uint8_t *dst)
 {
-  Hacl_Hash_Blake2s_Simd128_block_state_t block_state0 = (*state).block_state;
-  uint8_t nn = block_state0.snd;
-  uint8_t kk1 = block_state0.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
-  Hacl_Hash_Blake2s_Simd128_state_t scrut = *state;
+  Hacl_Hash_Blake2s_Simd128_block_state_t block_state0 = (*s).block_state;
+  bool last_node0 = block_state0.thd;
+  uint8_t nn0 = block_state0.snd;
+  uint8_t kk0 = block_state0.fst;
+  Hacl_Hash_Blake2b_index
+  i1 = { .key_length = kk0, .digest_length = nn0, .last_node = last_node0 };
+  Hacl_Hash_Blake2s_Simd128_state_t scrut = *s;
   Hacl_Hash_Blake2s_Simd128_block_state_t block_state = scrut.block_state;
   uint8_t *buf_ = scrut.buf;
   uint64_t total_len = scrut.total_len;
@@ -1017,9 +1058,14 @@ Hacl_Hash_Blake2s_Simd128_digest(Hacl_Hash_Blake2s_Simd128_state_t *state, uint8
   KRML_PRE_ALIGN(16) Lib_IntVector_Intrinsics_vec128 b[4U] KRML_POST_ALIGN(16) = { 0U };
   Hacl_Hash_Blake2s_Simd128_block_state_t
   tmp_block_state =
-    { .fst = i.key_length, .snd = i.digest_length, .thd = { .fst = wv0, .snd = b } };
-  Lib_IntVector_Intrinsics_vec128 *src_b = block_state.thd.snd;
-  Lib_IntVector_Intrinsics_vec128 *dst_b = tmp_block_state.thd.snd;
+    {
+      .fst = i1.key_length,
+      .snd = i1.digest_length,
+      .thd = i1.last_node,
+      .f3 = { .fst = wv0, .snd = b }
+    };
+  Lib_IntVector_Intrinsics_vec128 *src_b = block_state.f3.snd;
+  Lib_IntVector_Intrinsics_vec128 *dst_b = tmp_block_state.f3.snd;
   memcpy(dst_b, src_b, 4U * sizeof (Lib_IntVector_Intrinsics_vec128));
   uint64_t prev_len = total_len - (uint64_t)r;
   uint32_t ite;
@@ -1034,19 +1080,36 @@ Hacl_Hash_Blake2s_Simd128_digest(Hacl_Hash_Blake2s_Simd128_state_t *state, uint8
   uint8_t *buf_last = buf_1 + r - ite;
   uint8_t *buf_multi = buf_1;
   K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_
-  acc0 = tmp_block_state.thd;
+  acc0 = tmp_block_state.f3;
   Lib_IntVector_Intrinsics_vec128 *wv1 = acc0.fst;
   Lib_IntVector_Intrinsics_vec128 *hash0 = acc0.snd;
   uint32_t nb = 0U;
   Hacl_Hash_Blake2s_Simd128_update_multi(0U, wv1, hash0, prev_len, buf_multi, nb);
   uint64_t prev_len_last = total_len - (uint64_t)r;
   K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_
-  acc = tmp_block_state.thd;
+  acc = tmp_block_state.f3;
+  bool last_node1 = tmp_block_state.thd;
   Lib_IntVector_Intrinsics_vec128 *wv = acc.fst;
   Lib_IntVector_Intrinsics_vec128 *hash = acc.snd;
-  Hacl_Hash_Blake2s_Simd128_update_last(r, wv, hash, prev_len_last, r, buf_last);
-  uint8_t nn0 = tmp_block_state.snd;
-  Hacl_Hash_Blake2s_Simd128_finish((uint32_t)nn0, output, tmp_block_state.thd.snd);
+  Hacl_Hash_Blake2s_Simd128_update_last(r, wv, hash, last_node1, prev_len_last, r, buf_last);
+  uint8_t nn1 = tmp_block_state.snd;
+  Hacl_Hash_Blake2s_Simd128_finish((uint32_t)nn1, dst, tmp_block_state.f3.snd);
+  Hacl_Hash_Blake2s_Simd128_block_state_t block_state1 = (*s).block_state;
+  bool last_node = block_state1.thd;
+  uint8_t nn = block_state1.snd;
+  uint8_t kk = block_state1.fst;
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk, .digest_length = nn, .last_node = last_node }).digest_length;
+}
+
+Hacl_Hash_Blake2b_index Hacl_Hash_Blake2s_Simd128_info(Hacl_Hash_Blake2s_Simd128_state_t *s)
+{
+  Hacl_Hash_Blake2s_Simd128_block_state_t block_state = (*s).block_state;
+  bool last_node = block_state.thd;
+  uint8_t nn = block_state.snd;
+  uint8_t kk = block_state.fst;
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk, .digest_length = nn, .last_node = last_node });
 }
 
 /**
@@ -1057,8 +1120,8 @@ void Hacl_Hash_Blake2s_Simd128_free(Hacl_Hash_Blake2s_Simd128_state_t *state)
   Hacl_Hash_Blake2s_Simd128_state_t scrut = *state;
   uint8_t *buf = scrut.buf;
   Hacl_Hash_Blake2s_Simd128_block_state_t block_state = scrut.block_state;
-  Lib_IntVector_Intrinsics_vec128 *b = block_state.thd.snd;
-  Lib_IntVector_Intrinsics_vec128 *wv = block_state.thd.fst;
+  Lib_IntVector_Intrinsics_vec128 *b = block_state.f3.snd;
+  Lib_IntVector_Intrinsics_vec128 *wv = block_state.f3.fst;
   KRML_ALIGNED_FREE(wv);
   KRML_ALIGNED_FREE(b);
   KRML_HOST_FREE(buf);
@@ -1066,7 +1129,7 @@ void Hacl_Hash_Blake2s_Simd128_free(Hacl_Hash_Blake2s_Simd128_state_t *state)
 }
 
 /**
-  Copying. The key length (or absence thereof) must match between source and destination.
+  Copying. This preserves all parameters.
 */
 Hacl_Hash_Blake2s_Simd128_state_t
 *Hacl_Hash_Blake2s_Simd128_copy(Hacl_Hash_Blake2s_Simd128_state_t *state)
@@ -1075,9 +1138,10 @@ Hacl_Hash_Blake2s_Simd128_state_t
   Hacl_Hash_Blake2s_Simd128_block_state_t block_state0 = scrut.block_state;
   uint8_t *buf0 = scrut.buf;
   uint64_t total_len0 = scrut.total_len;
+  bool last_node = block_state0.thd;
   uint8_t nn = block_state0.snd;
   uint8_t kk1 = block_state0.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
+  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC(64U, sizeof (uint8_t));
   memcpy(buf, buf0, 64U * sizeof (uint8_t));
   Lib_IntVector_Intrinsics_vec128
@@ -1091,9 +1155,15 @@ Hacl_Hash_Blake2s_Simd128_state_t
       sizeof (Lib_IntVector_Intrinsics_vec128) * 4U);
   memset(b, 0U, 4U * sizeof (Lib_IntVector_Intrinsics_vec128));
   Hacl_Hash_Blake2s_Simd128_block_state_t
-  block_state = { .fst = i.key_length, .snd = i.digest_length, .thd = { .fst = wv, .snd = b } };
-  Lib_IntVector_Intrinsics_vec128 *src_b = block_state0.thd.snd;
-  Lib_IntVector_Intrinsics_vec128 *dst_b = block_state.thd.snd;
+  block_state =
+    {
+      .fst = i.key_length,
+      .snd = i.digest_length,
+      .thd = i.last_node,
+      .f3 = { .fst = wv, .snd = b }
+    };
+  Lib_IntVector_Intrinsics_vec128 *src_b = block_state0.f3.snd;
+  Lib_IntVector_Intrinsics_vec128 *dst_b = block_state.f3.snd;
   memcpy(dst_b, src_b, 4U * sizeof (Lib_IntVector_Intrinsics_vec128));
   Hacl_Hash_Blake2s_Simd128_state_t
   s = { .block_state = block_state, .buf = buf, .total_len = total_len0 };
@@ -1135,8 +1205,14 @@ Hacl_Hash_Blake2s_Simd128_hash_with_key(
   Lib_Memzero0_memzero(b, 4U, Lib_IntVector_Intrinsics_vec128, void *);
 }
 
+/**
+Write the BLAKE2s digest of message `input` using key `key` and
+parameters `params` into `output`. The `key` array must be of length
+`params.key_length`. The `output` array must be of length
+`params.digest_length`.
+*/
 void
-Hacl_Hash_Blake2s_Simd128_hash_with_key_and_paramas(
+Hacl_Hash_Blake2s_Simd128_hash_with_key_and_params(
   uint8_t *output,
   uint8_t *input,
   uint32_t input_len,
diff --git a/src/Hacl_Hash_SHA3.c b/src/Hacl_Hash_SHA3.c
index 89bb0491..9cf5abb3 100644
--- a/src/Hacl_Hash_SHA3.c
+++ b/src/Hacl_Hash_SHA3.c
@@ -2166,7 +2166,7 @@ void Hacl_Hash_SHA3_state_free(uint64_t *s)
 Absorb number of input blocks and write the output state
 
   This function is intended to receive a hash state and input buffer.
-  It prcoesses an input of multiple of 168-bytes (SHAKE128 block size),
+  It processes an input of multiple of 168-bytes (SHAKE128 block size),
   any additional bytes of final partial block are ignored.
 
   The argument `state` (IN/OUT) points to hash state, i.e., uint64_t[25]
@@ -2191,14 +2191,14 @@ Hacl_Hash_SHA3_shake128_absorb_nblocks(uint64_t *state, uint8_t *input, uint32_t
 Absorb a final partial block of input and write the output state
 
   This function is intended to receive a hash state and input buffer.
-  It prcoesses a sequence of bytes at end of input buffer that is less 
+  It processes a sequence of bytes at end of input buffer that is less
   than 168-bytes (SHAKE128 block size),
   any bytes of full blocks at start of input buffer are ignored.
 
   The argument `state` (IN/OUT) points to hash state, i.e., uint64_t[25]
   The argument `input` (IN) points to `inputByteLen` bytes of valid memory,
   i.e., uint8_t[inputByteLen]
-  
+
   Note: Full size of input buffer must be passed to `inputByteLen` including
   the number of full-block bytes at start of input buffer that are ignored
 */
diff --git a/src/Hacl_Hash_SHA3_Simd256.c b/src/Hacl_Hash_SHA3_Simd256.c
index 131c34e6..e0bb7e0b 100644
--- a/src/Hacl_Hash_SHA3_Simd256.c
+++ b/src/Hacl_Hash_SHA3_Simd256.c
@@ -5992,12 +5992,12 @@ void Hacl_Hash_SHA3_Simd256_state_free(Lib_IntVector_Intrinsics_vec256 *s)
 Absorb number of blocks of 4 input buffers and write the output states
 
   This function is intended to receive a quadruple hash state and 4 input buffers.
-  It prcoesses an inputs of multiple of 168-bytes (SHAKE128 block size),
+  It processes an inputs of multiple of 168-bytes (SHAKE128 block size),
   any additional bytes of final partial block for each buffer are ignored.
 
   The argument `state` (IN/OUT) points to quadruple hash state,
   i.e., Lib_IntVector_Intrinsics_vec256[25]
-  The arguments `input0/input1/input2/input3` (IN) point to `inputByteLen` bytes 
+  The arguments `input0/input1/input2/input3` (IN) point to `inputByteLen` bytes
   of valid memory for each buffer, i.e., uint8_t[inputByteLen]
 */
 void
@@ -6038,15 +6038,15 @@ Hacl_Hash_SHA3_Simd256_shake128_absorb_nblocks(
 Absorb a final partial blocks of 4 input buffers and write the output states
 
   This function is intended to receive a quadruple hash state and 4 input buffers.
-  It prcoesses a sequence of bytes at end of each input buffer that is less 
+  It processes a sequence of bytes at end of each input buffer that is less
   than 168-bytes (SHAKE128 block size),
   any bytes of full blocks at start of input buffers are ignored.
 
   The argument `state` (IN/OUT) points to quadruple hash state,
   i.e., Lib_IntVector_Intrinsics_vec256[25]
-  The arguments `input0/input1/input2/input3` (IN) point to `inputByteLen` bytes 
+  The arguments `input0/input1/input2/input3` (IN) point to `inputByteLen` bytes
   of valid memory for each buffer, i.e., uint8_t[inputByteLen]
-  
+
   Note: Full size of input buffers must be passed to `inputByteLen` including
   the number of full-block bytes at start of each input buffer that are ignored
 */
@@ -6378,7 +6378,7 @@ Squeeze a quadruple hash state to 4 output buffers
 
   The argument `state` (IN) points to quadruple hash state,
   i.e., Lib_IntVector_Intrinsics_vec256[25]
-  The arguments `output0/output1/output2/output3` (OUT) point to `outputByteLen` bytes 
+  The arguments `output0/output1/output2/output3` (OUT) point to `outputByteLen` bytes
   of valid memory for each buffer, i.e., uint8_t[inputByteLen]
 */
 void
diff --git a/src/Hacl_K256_ECDSA.c b/src/Hacl_K256_ECDSA.c
index 0b72b166..34793c5e 100644
--- a/src/Hacl_K256_ECDSA.c
+++ b/src/Hacl_K256_ECDSA.c
@@ -351,7 +351,7 @@ static inline uint64_t load_qelem_check(uint64_t *f, uint8_t *b)
     1U,
     uint64_t beq = FStar_UInt64_eq_mask(f[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(f[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL))););
+    acc = (beq & acc) | (~beq & blt););
   uint64_t is_lt_q = acc;
   return ~is_zero & is_lt_q;
 }
@@ -372,11 +372,7 @@ static inline bool load_qelem_vartime(uint64_t *f, uint8_t *b)
   uint64_t a2 = f[2U];
   uint64_t a3 = f[3U];
   bool is_lt_q_b;
-  if (a3 < 0xffffffffffffffffULL)
-  {
-    is_lt_q_b = true;
-  }
-  else if (a2 < 0xfffffffffffffffeULL)
+  if (a3 < 0xffffffffffffffffULL || a2 < 0xfffffffffffffffeULL)
   {
     is_lt_q_b = true;
   }
@@ -567,11 +563,7 @@ static inline bool is_qelem_le_q_halved_vartime(uint64_t *f)
   {
     return false;
   }
-  if (a2 < 0xffffffffffffffffULL)
-  {
-    return true;
-  }
-  if (a1 < 0x5d576e7357a4501dULL)
+  if (a2 < 0xffffffffffffffffULL || a1 < 0x5d576e7357a4501dULL)
   {
     return true;
   }
diff --git a/src/Hacl_RSAPSS.c b/src/Hacl_RSAPSS.c
index 71e141d0..aba81c64 100644
--- a/src/Hacl_RSAPSS.c
+++ b/src/Hacl_RSAPSS.c
@@ -167,7 +167,7 @@ static inline uint64_t check_num_bits_u64(uint32_t bs, uint64_t *b)
   {
     uint64_t beq = FStar_UInt64_eq_mask(b[i], b2[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(b[i], b2[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+    acc = (beq & acc) | (~beq & blt);
   }
   uint64_t res = acc;
   return res;
@@ -189,7 +189,7 @@ static inline uint64_t check_modulus_u64(uint32_t modBits, uint64_t *n)
   {
     uint64_t beq = FStar_UInt64_eq_mask(b2[i], n[i]);
     uint64_t blt = ~FStar_UInt64_gte_mask(b2[i], n[i]);
-    acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+    acc = (beq & acc) | (~beq & blt);
   }
   uint64_t res = acc;
   uint64_t m1 = res;
@@ -288,11 +288,7 @@ pss_verify(
     em_0 = 0U;
   }
   uint8_t em_last = em[emLen - 1U];
-  if (emLen < saltLen + hash_len(a) + 2U)
-  {
-    return false;
-  }
-  if (!(em_last == 0xbcU && em_0 == 0U))
+  if (emLen < saltLen + hash_len(a) + 2U || !(em_last == 0xbcU && em_0 == 0U))
   {
     return false;
   }
@@ -553,7 +549,7 @@ Hacl_RSAPSS_rsapss_verify(
     {
       uint64_t beq = FStar_UInt64_eq_mask(s[i], n[i]);
       uint64_t blt = ~FStar_UInt64_gte_mask(s[i], n[i]);
-      acc = (beq & acc) | (~beq & ((blt & 0xFFFFFFFFFFFFFFFFULL) | (~blt & 0ULL)));
+      acc = (beq & acc) | (~beq & blt);
     }
     uint64_t mask = acc;
     bool res;
@@ -568,10 +564,9 @@ Hacl_RSAPSS_rsapss_verify(
         eBits,
         e,
         m);
-      bool ite;
       if (!((modBits - 1U) % 8U == 0U))
       {
-        ite = true;
+        res = true;
       }
       else
       {
@@ -579,15 +574,7 @@ Hacl_RSAPSS_rsapss_verify(
         uint32_t j = (modBits - 1U) % 64U;
         uint64_t tmp = m[i];
         uint64_t get_bit = tmp >> j & 1ULL;
-        ite = get_bit == 0ULL;
-      }
-      if (ite)
-      {
-        res = true;
-      }
-      else
-      {
-        res = false;
+        res = get_bit == 0ULL;
       }
     }
     else
diff --git a/src/msvc/EverCrypt_HMAC.c b/src/msvc/EverCrypt_HMAC.c
index 386cb17f..649f1e15 100644
--- a/src/msvc/EverCrypt_HMAC.c
+++ b/src/msvc/EverCrypt_HMAC.c
@@ -620,7 +620,7 @@ EverCrypt_HMAC_compute_blake2s(
   if (data_len == 0U)
   {
     uint32_t wv[16U] = { 0U };
-    Hacl_Hash_Blake2s_update_last(64U, wv, s0, 0ULL, 64U, ipad);
+    Hacl_Hash_Blake2s_update_last(64U, wv, s0, false, 0ULL, 64U, ipad);
   }
   else
   {
@@ -655,6 +655,7 @@ EverCrypt_HMAC_compute_blake2s(
     Hacl_Hash_Blake2s_update_last(rem_len,
       wv1,
       s0,
+      false,
       (uint64_t)64U + (uint64_t)full_blocks_len,
       rem_len,
       rem);
@@ -693,6 +694,7 @@ EverCrypt_HMAC_compute_blake2s(
   Hacl_Hash_Blake2s_update_last(rem_len,
     wv1,
     s0,
+    false,
     (uint64_t)64U + (uint64_t)full_blocks_len,
     rem_len,
     rem);
@@ -757,7 +759,13 @@ EverCrypt_HMAC_compute_blake2b(
   if (data_len == 0U)
   {
     uint64_t wv[16U] = { 0U };
-    Hacl_Hash_Blake2b_update_last(128U, wv, s0, FStar_UInt128_uint64_to_uint128(0ULL), 128U, ipad);
+    Hacl_Hash_Blake2b_update_last(128U,
+      wv,
+      s0,
+      false,
+      FStar_UInt128_uint64_to_uint128(0ULL),
+      128U,
+      ipad);
   }
   else
   {
@@ -792,6 +800,7 @@ EverCrypt_HMAC_compute_blake2b(
     Hacl_Hash_Blake2b_update_last(rem_len,
       wv1,
       s0,
+      false,
       FStar_UInt128_add(FStar_UInt128_uint64_to_uint128((uint64_t)128U),
         FStar_UInt128_uint64_to_uint128((uint64_t)full_blocks_len)),
       rem_len,
@@ -831,6 +840,7 @@ EverCrypt_HMAC_compute_blake2b(
   Hacl_Hash_Blake2b_update_last(rem_len,
     wv1,
     s0,
+    false,
     FStar_UInt128_add(FStar_UInt128_uint64_to_uint128((uint64_t)128U),
       FStar_UInt128_uint64_to_uint128((uint64_t)full_blocks_len)),
     rem_len,
diff --git a/src/msvc/EverCrypt_Hash.c b/src/msvc/EverCrypt_Hash.c
index bfafa9be..153063cc 100644
--- a/src/msvc/EverCrypt_Hash.c
+++ b/src/msvc/EverCrypt_Hash.c
@@ -616,7 +616,7 @@ update_last(EverCrypt_Hash_state_s *s, uint64_t prev_len, uint8_t *last, uint32_
   {
     uint32_t *p1 = scrut.case_Blake2S_s;
     uint32_t wv[16U] = { 0U };
-    Hacl_Hash_Blake2s_update_last(last_len, wv, p1, prev_len, last_len, last);
+    Hacl_Hash_Blake2s_update_last(last_len, wv, p1, false, prev_len, last_len, last);
     return;
   }
   if (scrut.tag == Blake2S_128_s)
@@ -624,7 +624,7 @@ update_last(EverCrypt_Hash_state_s *s, uint64_t prev_len, uint8_t *last, uint32_
     Lib_IntVector_Intrinsics_vec128 *p1 = scrut.case_Blake2S_128_s;
     #if HACL_CAN_COMPILE_VEC128
     KRML_PRE_ALIGN(16) Lib_IntVector_Intrinsics_vec128 wv[4U] KRML_POST_ALIGN(16) = { 0U };
-    Hacl_Hash_Blake2s_Simd128_update_last(last_len, wv, p1, prev_len, last_len, last);
+    Hacl_Hash_Blake2s_Simd128_update_last(last_len, wv, p1, false, prev_len, last_len, last);
     return;
     #else
     KRML_MAYBE_UNUSED_VAR(p1);
@@ -638,6 +638,7 @@ update_last(EverCrypt_Hash_state_s *s, uint64_t prev_len, uint8_t *last, uint32_
     Hacl_Hash_Blake2b_update_last(last_len,
       wv,
       p1,
+      false,
       FStar_UInt128_uint64_to_uint128(prev_len),
       last_len,
       last);
@@ -651,6 +652,7 @@ update_last(EverCrypt_Hash_state_s *s, uint64_t prev_len, uint8_t *last, uint32_
     Hacl_Hash_Blake2b_Simd256_update_last(last_len,
       wv,
       p1,
+      false,
       FStar_UInt128_uint64_to_uint128(prev_len),
       last_len,
       last);
diff --git a/src/msvc/Hacl_Bignum32.c b/src/msvc/Hacl_Bignum32.c
index 55c3f90c..f62abd35 100644
--- a/src/msvc/Hacl_Bignum32.c
+++ b/src/msvc/Hacl_Bignum32.c
@@ -46,9 +46,18 @@ of `len` unsigned 32-bit integers, i.e. uint32_t[len].
 /**
 Write `a + b mod 2 ^ (32 * len)` in `res`.
 
-  This functions returns the carry.
-
-  The arguments a, b and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len]
+  This function returns the carry.
+  
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `b` or `res`. May have exactly equal memory
+    location to `b` or `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `a` or `res`. May have exactly
+    equal memory location to `a` or `res`.
+  @param[out] res Points to `len` number of limbs where the carry is written, i.e. `uint32_t[len]`.
+    Must not partially overlap the memory locations of `a` or `b`. May have
+    exactly equal memory location to `a` or `b`.
 */
 uint32_t Hacl_Bignum32_add(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res)
 {
@@ -60,7 +69,16 @@ Write `a - b mod 2 ^ (32 * len)` in `res`.
 
   This functions returns the carry.
 
-  The arguments a, b and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len]
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `b` or `res`. May have exactly
+    equal memory location to `b` or `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `a` or `res`. May have exactly
+    equal memory location to `a` or `res`.
+  @param[out] res Points to `len` number of limbs where the carry is written, i.e. `uint32_t[len]`.
+    Must not partially overlap the memory locations of `a` or `b`. May have
+    exactly equal memory location to `a` or `b`.
 */
 uint32_t Hacl_Bignum32_sub(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res)
 {
@@ -70,12 +88,23 @@ uint32_t Hacl_Bignum32_sub(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res
 /**
 Write `(a + b) mod n` in `res`.
 
-  The arguments a, b, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • a < n
-  • b < n
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `b` or `res`. May have exactly
+    equal memory location to `b` or `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `a` or `res`. May have exactly
+    equal memory location to `a` or `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a`, `b`, and `res`.
+  @param[out] res Points to `len` number of limbs where the result is written, i.e. `uint32_t[len]`.
+    Must not partially overlap the memory locations of `a` or `b`. May have
+    exactly equal memory location to `a` or `b`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `a < n`
+    - `b < n`
 */
 void Hacl_Bignum32_add_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *b, uint32_t *res)
 {
@@ -85,12 +114,23 @@ void Hacl_Bignum32_add_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *b,
 /**
 Write `(a - b) mod n` in `res`.
 
-  The arguments a, b, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • a < n
-  • b < n
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `b` or `res`. May have exactly
+    equal memory location to `b` or `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must not
+    partially overlap the memory locations of `a` or `res`. May have exactly
+    equal memory location to `a` or `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a`, `b`, and `res`.
+  @param[out] res Points to `len` number of limbs where the result is written, i.e. `uint32_t[len]`.
+    Must not partially overlap the memory locations of `a` or `b`. May have
+    exactly equal memory location to `a` or `b`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `a < n`
+    - `b < n`
 */
 void Hacl_Bignum32_sub_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *b, uint32_t *res)
 {
@@ -100,8 +140,13 @@ void Hacl_Bignum32_sub_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *b,
 /**
 Write `a * b` in `res`.
 
-  The arguments a and b are meant to be `len` limbs in size, i.e. uint32_t[len].
-  The outparam res is meant to be `2*len` limbs in size, i.e. uint32_t[2*len].
+  @param[in] len Number of limbs.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `b` and `res`.
+  @param[in] b Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `a` and `res`.
+  @param[out] res Points to `2*len` number of limbs where the result is written, i.e. `uint32_t[2*len]`.
+    Must be disjoint from the memory locations of `a` and `b`.
 */
 void Hacl_Bignum32_mul(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res)
 {
@@ -114,8 +159,10 @@ void Hacl_Bignum32_mul(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res)
 /**
 Write `a * a` in `res`.
 
-  The argument a is meant to be `len` limbs in size, i.e. uint32_t[len].
-  The outparam res is meant to be `2*len` limbs in size, i.e. uint32_t[2*len].
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[out] res Points to `2*len` number of limbs where the result is written, i.e. `uint32_t[2*len]`.
+    Must be disjoint from the memory location of `a`.
 */
 void Hacl_Bignum32_sqr(uint32_t len, uint32_t *a, uint32_t *res)
 {
@@ -149,13 +196,19 @@ bn_slow_precomp(
 /**
 Write `a mod n` in `res`.
 
-  The argument a is meant to be `2*len` limbs in size, i.e. uint32_t[2*len].
-  The argument n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  The function returns false if any of the following preconditions are violated,
-  true otherwise.
-   • 1 < n
-   • n % 2 = 1 
+  @param[in] a Points to `2*len` number of limbs, i.e. `uint32_t[2*len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `n`.
+  
+  @return `false` if any precondition is violated, `true` otherwise.
+  
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `1 < n`
+    - `n % 2 = 1`
 */
 bool Hacl_Bignum32_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *res)
 {
@@ -195,22 +248,30 @@ bool Hacl_Bignum32_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *res)
 /**
 Write `a ^ b mod n` in `res`.
 
-  The arguments a, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  The argument b is a bignum of any size, and bBits is an upper bound on the
-  number of significant bits of b. A tighter bound results in faster execution
-  time. When in doubt, the number of bits for the bignum size is always a safe
-  default, e.g. if b is a 4096-bit bignum, bBits should be 4096.
-
-  The function is *NOT* constant-time on the argument b. See the
-  mod_exp_consttime_* functions for constant-time variants.
-
-  The function returns false if any of the following preconditions are violated,
-  true otherwise.
-   • n % 2 = 1
-   • 1 < n
-   • b < pow2 bBits
-   • a < n
+  This function is *NOT* constant-time on the argument `b`. See the
+  `mod_exp_consttime_*` functions for constant-time variants.
+
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `n` and `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `res`.
+  @param[in] b Points to a bignum of any size, with an upper bound of `bBits` number of
+    significant bits. Must be disjoint from the memory location of `res`.
+  @param[in] bBits An upper bound on the number of significant bits of `b`.
+    A tighter bound results in faster execution time. When in doubt, the number
+    of bits for the bignum size is always a safe default, e.g. if `b` is a 4096-bit
+    bignum, `bBits` should be `4096`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a`, `b`, and `n`.
+    
+  @return `false` if any preconditions are violated, `true` otherwise.
+  
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n % 2 = 1`
+    - `1 < n`
+    - `b < pow2 bBits`
+    - `a < n`
 */
 bool
 Hacl_Bignum32_mod_exp_vartime(
@@ -238,22 +299,30 @@ Hacl_Bignum32_mod_exp_vartime(
 /**
 Write `a ^ b mod n` in `res`.
 
-  The arguments a, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  The argument b is a bignum of any size, and bBits is an upper bound on the
-  number of significant bits of b. A tighter bound results in faster execution
-  time. When in doubt, the number of bits for the bignum size is always a safe
-  default, e.g. if b is a 4096-bit bignum, bBits should be 4096.
-
-  This function is constant-time over its argument b, at the cost of a slower
-  execution time than mod_exp_vartime.
-
-  The function returns false if any of the following preconditions are violated,
-  true otherwise.
-   • n % 2 = 1
-   • 1 < n
-   • b < pow2 bBits
-   • a < n
+  This function is constant-time over its argument `b`, at the cost of a slower
+  execution time than `mod_exp_vartime_*`.
+  
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `n` and `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `res`.
+  @param[in] b Points to a bignum of any size, with an upper bound of `bBits` number of
+    significant bits. Must be disjoint from the memory location of `res`.
+  @param[in] bBits An upper bound on the number of significant bits of `b`.
+    A tighter bound results in faster execution time. When in doubt, the number
+    of bits for the bignum size is always a safe default, e.g. if `b` is a 4096-bit
+    bignum, `bBits` should be `4096`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a`, `b`, and `n`.
+    
+  @return `false` if any preconditions are violated, `true` otherwise.
+
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n % 2 = 1`
+    - `1 < n`
+    - `b < pow2 bBits`
+    - `a < n`
 */
 bool
 Hacl_Bignum32_mod_exp_consttime(
@@ -281,18 +350,23 @@ Hacl_Bignum32_mod_exp_consttime(
 /**
 Write `a ^ (-1) mod n` in `res`.
 
-  The arguments a, n and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • n is a prime
-
-  The function returns false if any of the following preconditions are violated,
-  true otherwise.
-  • n % 2 = 1
-  • 1 < n
-  • 0 < a
-  • a < n
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `n` and `res`.
+  @param[in] n Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `res`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `a` and `n`.
+    
+  @return `false` if any preconditions (except the precondition: `n` is a prime)
+    are violated, `true` otherwise.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n` is a prime
+    - `n % 2 = 1`
+    - `1 < n`
+    - `0 < a`
+    - `a < n`
 */
 bool Hacl_Bignum32_mod_inv_prime_vartime(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *res)
 {
@@ -393,15 +467,16 @@ bool Hacl_Bignum32_mod_inv_prime_vartime(uint32_t len, uint32_t *n, uint32_t *a,
 /**
 Heap-allocate and initialize a montgomery context.
 
-  The argument n is meant to be `len` limbs in size, i.e. uint32_t[len].
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • n % 2 = 1
-  • 1 < n
+  @param n Points to `len` number of limbs, i.e. `uint32_t[len]`.
 
-  The caller will need to call Hacl_Bignum32_mont_ctx_free on the return value
-  to avoid memory leaks.
+  @return A pointer to an allocated and initialized Montgomery context is returned.
+    Clients will need to call `Hacl_Bignum32_mont_ctx_free` on the return value to
+    avoid memory leaks.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n % 2 = 1`
+    - `1 < n`
 */
 Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32
 *Hacl_Bignum32_mont_ctx_init(uint32_t len, uint32_t *n)
@@ -429,7 +504,7 @@ Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32
 /**
 Deallocate the memory previously allocated by Hacl_Bignum32_mont_ctx_init.
 
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
+  @param k Points to a Montgomery context obtained through `Hacl_Bignum32_mont_ctx_init`.
 */
 void Hacl_Bignum32_mont_ctx_free(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k)
 {
@@ -444,9 +519,11 @@ void Hacl_Bignum32_mont_ctx_free(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k)
 /**
 Write `a mod n` in `res`.
 
-  The argument a is meant to be `2*len` limbs in size, i.e. uint32_t[2*len].
-  The outparam res is meant to be `len` limbs in size, i.e. uint32_t[len].
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
+  @param[in] k Points to a Montgomery context obtained from `Hacl_Bignum32_mont_ctx_init`.
+  @param[in] a Points to `2*len` number of limbs, i.e. `uint32_t[2*len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `a`.
 */
 void
 Hacl_Bignum32_mod_precomp(
@@ -464,21 +541,25 @@ Hacl_Bignum32_mod_precomp(
 /**
 Write `a ^ b mod n` in `res`.
 
-  The arguments a and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
-
-  The argument b is a bignum of any size, and bBits is an upper bound on the
-  number of significant bits of b. A tighter bound results in faster execution
-  time. When in doubt, the number of bits for the bignum size is always a safe
-  default, e.g. if b is a 4096-bit bignum, bBits should be 4096.
-
-  The function is *NOT* constant-time on the argument b. See the
-  mod_exp_consttime_* functions for constant-time variants.
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • b < pow2 bBits
-  • a < n
+  This function is *NOT* constant-time on the argument `b`. See the
+  `mod_exp_consttime_*` functions for constant-time variants.
+
+  @param[in] k Points to a Montgomery context obtained from `Hacl_Bignum32_mont_ctx_init`.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[in] b Points to a bignum of any size, with an upper bound of `bBits` number of
+    significant bits. Must be disjoint from the memory location of `res`.
+  @param[in] bBits An upper bound on the number of significant bits of `b`.
+    A tighter bound results in faster execution time. When in doubt, the number
+    of bits for the bignum size is always a safe default, e.g. if `b` is a 4096-bit
+    bignum, `bBits` should be `4096`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `b`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `b < pow2 bBits`
+    - `a < n`
 */
 void
 Hacl_Bignum32_mod_exp_vartime_precomp(
@@ -505,21 +586,25 @@ Hacl_Bignum32_mod_exp_vartime_precomp(
 /**
 Write `a ^ b mod n` in `res`.
 
-  The arguments a and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
-
-  The argument b is a bignum of any size, and bBits is an upper bound on the
-  number of significant bits of b. A tighter bound results in faster execution
-  time. When in doubt, the number of bits for the bignum size is always a safe
-  default, e.g. if b is a 4096-bit bignum, bBits should be 4096.
-
   This function is constant-time over its argument b, at the cost of a slower
-  execution time than mod_exp_vartime_*.
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • b < pow2 bBits
-  • a < n
+  execution time than `mod_exp_vartime_*`.
+
+  @param[in] k Points to a Montgomery context obtained from `Hacl_Bignum32_mont_ctx_init`.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[in] b Points to a bignum of any size, with an upper bound of `bBits` number of
+    significant bits. Must be disjoint from the memory location of `res`.
+  @param[in] bBits An upper bound on the number of significant bits of `b`.
+    A tighter bound results in faster execution time. When in doubt, the number
+    of bits for the bignum size is always a safe default, e.g. if `b` is a 4096-bit
+    bignum, `bBits` should be `4096`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory locations of `a` and `b`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `b < pow2 bBits`
+    - `a < n`
 */
 void
 Hacl_Bignum32_mod_exp_consttime_precomp(
@@ -546,14 +631,17 @@ Hacl_Bignum32_mod_exp_consttime_precomp(
 /**
 Write `a ^ (-1) mod n` in `res`.
 
-  The argument a and the outparam res are meant to be `len` limbs in size, i.e. uint32_t[len].
-  The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.
-
-  Before calling this function, the caller will need to ensure that the following
-  preconditions are observed.
-  • n is a prime
-  • 0 < a
-  • a < n
+  @param[in] k Points to a Montgomery context obtained through `Hacl_Bignum32_mont_ctx_init`.
+  @param[in] a Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `res`.
+  @param[out] res Points to `len` number of limbs, i.e. `uint32_t[len]`. Must be
+    disjoint from the memory location of `a`.
+    
+  @pre Before calling this function, the caller will need to ensure that the following
+    preconditions are observed:
+    - `n` is a prime
+    - `0 < a`
+    - `a < n`
 */
 void
 Hacl_Bignum32_mod_inv_prime_vartime_precomp(
@@ -623,13 +711,13 @@ Hacl_Bignum32_mod_inv_prime_vartime_precomp(
 /**
 Load a bid-endian bignum from memory.
 
-  The argument b points to `len` bytes of valid memory.
-  The function returns a heap-allocated bignum of size sufficient to hold the
-   result of loading b, or NULL if either the allocation failed, or the amount of
-    required memory would exceed 4GB.
-
-  If the return value is non-null, clients must eventually call free(3) on it to
-  avoid memory leaks.
+  @param len Size of `b` as number of bytes.
+  @param b Points to `len` number of bytes, i.e. `uint8_t[len]`.
+  
+  @return A heap-allocated bignum of size sufficient to hold the result of
+    loading `b`. Otherwise, `NULL`, if either the allocation failed, or the amount
+    of required memory would exceed 4GB. Clients must `free(3)` any non-null return
+    value to avoid memory leaks.
 */
 uint32_t *Hacl_Bignum32_new_bn_from_bytes_be(uint32_t len, uint8_t *b)
 {
@@ -664,13 +752,13 @@ uint32_t *Hacl_Bignum32_new_bn_from_bytes_be(uint32_t len, uint8_t *b)
 /**
 Load a little-endian bignum from memory.
 
-  The argument b points to `len` bytes of valid memory.
-  The function returns a heap-allocated bignum of size sufficient to hold the
-   result of loading b, or NULL if either the allocation failed, or the amount of
-    required memory would exceed 4GB.
-
-  If the return value is non-null, clients must eventually call free(3) on it to
-  avoid memory leaks.
+  @param len Size of `b` as number of bytes.
+  @param b Points to `len` number of bytes, i.e. `uint8_t[len]`.
+  
+  @return A heap-allocated bignum of size sufficient to hold the result of
+    loading `b`. Otherwise, `NULL`, if either the allocation failed, or the amount
+    of required memory would exceed 4GB. Clients must `free(3)` any non-null return
+    value to avoid memory leaks.
 */
 uint32_t *Hacl_Bignum32_new_bn_from_bytes_le(uint32_t len, uint8_t *b)
 {
@@ -707,8 +795,11 @@ uint32_t *Hacl_Bignum32_new_bn_from_bytes_le(uint32_t len, uint8_t *b)
 /**
 Serialize a bignum into big-endian memory.
 
-  The argument b points to a bignum of ⌈len / 4⌉ size.
-  The outparam res points to `len` bytes of valid memory.
+  @param[in] len Size of `b` as number of bytes.
+  @param[in] b Points to a bignum of `ceil(len/4)` size. Must be disjoint from
+    the memory location of `res`.
+  @param[out] res Points to `len` number of bytes, i.e. `uint8_t[len]`. Must be
+    disjoint from the memory location of `b`.
 */
 void Hacl_Bignum32_bn_to_bytes_be(uint32_t len, uint32_t *b, uint8_t *res)
 {
@@ -727,8 +818,11 @@ void Hacl_Bignum32_bn_to_bytes_be(uint32_t len, uint32_t *b, uint8_t *res)
 /**
 Serialize a bignum into little-endian memory.
 
-  The argument b points to a bignum of ⌈len / 4⌉ size.
-  The outparam res points to `len` bytes of valid memory.
+  @param[in] len Size of `b` as number of bytes.
+  @param[in] b Points to a bignum of `ceil(len/4)` size. Must be disjoint from
+    the memory location of `res`.
+  @param[out] res Points to `len` number of bytes, i.e. `uint8_t[len]`. Must be
+    disjoint from the memory location of `b`.
 */
 void Hacl_Bignum32_bn_to_bytes_le(uint32_t len, uint32_t *b, uint8_t *res)
 {
@@ -753,7 +847,11 @@ void Hacl_Bignum32_bn_to_bytes_le(uint32_t len, uint32_t *b, uint8_t *res)
 /**
 Returns 2^32 - 1 if a < b, otherwise returns 0.
 
- The arguments a and b are meant to be `len` limbs in size, i.e. uint32_t[len].
+  @param len Number of limbs.
+  @param a Points to `len` number of limbs, i.e. `uint32_t[len]`.
+  @param b Points to `len` number of limbs, i.e. `uint32_t[len]`.
+  
+  @return `2^32 - 1` if `a < b`, otherwise, `0`.
 */
 uint32_t Hacl_Bignum32_lt_mask(uint32_t len, uint32_t *a, uint32_t *b)
 {
@@ -770,7 +868,11 @@ uint32_t Hacl_Bignum32_lt_mask(uint32_t len, uint32_t *a, uint32_t *b)
 /**
 Returns 2^32 - 1 if a = b, otherwise returns 0.
 
- The arguments a and b are meant to be `len` limbs in size, i.e. uint32_t[len].
+  @param len Number of limbs.
+  @param a Points to `len` number of limbs, i.e. `uint32_t[len]`.
+  @param b Points to `len` number of limbs, i.e. `uint32_t[len]`.
+  
+  @return `2^32 - 1` if a = b, otherwise, `0`.
 */
 uint32_t Hacl_Bignum32_eq_mask(uint32_t len, uint32_t *a, uint32_t *b)
 {
diff --git a/src/msvc/Hacl_HMAC.c b/src/msvc/Hacl_HMAC.c
index 63ab2032..32dab3a5 100644
--- a/src/msvc/Hacl_HMAC.c
+++ b/src/msvc/Hacl_HMAC.c
@@ -609,7 +609,7 @@ Hacl_HMAC_compute_blake2s_32(
   if (data_len == 0U)
   {
     uint32_t wv[16U] = { 0U };
-    Hacl_Hash_Blake2s_update_last(64U, wv, s0, 0ULL, 64U, ipad);
+    Hacl_Hash_Blake2s_update_last(64U, wv, s0, false, 0ULL, 64U, ipad);
   }
   else
   {
@@ -644,6 +644,7 @@ Hacl_HMAC_compute_blake2s_32(
     Hacl_Hash_Blake2s_update_last(rem_len,
       wv1,
       s0,
+      false,
       (uint64_t)64U + (uint64_t)full_blocks_len,
       rem_len,
       rem);
@@ -682,6 +683,7 @@ Hacl_HMAC_compute_blake2s_32(
   Hacl_Hash_Blake2s_update_last(rem_len,
     wv1,
     s0,
+    false,
     (uint64_t)64U + (uint64_t)full_blocks_len,
     rem_len,
     rem);
@@ -752,7 +754,13 @@ Hacl_HMAC_compute_blake2b_32(
   if (data_len == 0U)
   {
     uint64_t wv[16U] = { 0U };
-    Hacl_Hash_Blake2b_update_last(128U, wv, s0, FStar_UInt128_uint64_to_uint128(0ULL), 128U, ipad);
+    Hacl_Hash_Blake2b_update_last(128U,
+      wv,
+      s0,
+      false,
+      FStar_UInt128_uint64_to_uint128(0ULL),
+      128U,
+      ipad);
   }
   else
   {
@@ -787,6 +795,7 @@ Hacl_HMAC_compute_blake2b_32(
     Hacl_Hash_Blake2b_update_last(rem_len,
       wv1,
       s0,
+      false,
       FStar_UInt128_add(FStar_UInt128_uint64_to_uint128((uint64_t)128U),
         FStar_UInt128_uint64_to_uint128((uint64_t)full_blocks_len)),
       rem_len,
@@ -826,6 +835,7 @@ Hacl_HMAC_compute_blake2b_32(
   Hacl_Hash_Blake2b_update_last(rem_len,
     wv1,
     s0,
+    false,
     FStar_UInt128_add(FStar_UInt128_uint64_to_uint128((uint64_t)128U),
       FStar_UInt128_uint64_to_uint128((uint64_t)full_blocks_len)),
     rem_len,
diff --git a/src/msvc/Hacl_HMAC_Blake2b_256.c b/src/msvc/Hacl_HMAC_Blake2b_256.c
index cd16e65e..5e7605bf 100644
--- a/src/msvc/Hacl_HMAC_Blake2b_256.c
+++ b/src/msvc/Hacl_HMAC_Blake2b_256.c
@@ -96,6 +96,7 @@ Hacl_HMAC_Blake2b_256_compute_blake2b_256(
     Hacl_Hash_Blake2b_Simd256_update_last(128U,
       wv,
       s0,
+      false,
       FStar_UInt128_uint64_to_uint128(0ULL),
       128U,
       ipad);
@@ -138,6 +139,7 @@ Hacl_HMAC_Blake2b_256_compute_blake2b_256(
     Hacl_Hash_Blake2b_Simd256_update_last(rem_len,
       wv1,
       s0,
+      false,
       FStar_UInt128_add(FStar_UInt128_uint64_to_uint128((uint64_t)128U),
         FStar_UInt128_uint64_to_uint128((uint64_t)full_blocks_len)),
       rem_len,
@@ -182,6 +184,7 @@ Hacl_HMAC_Blake2b_256_compute_blake2b_256(
   Hacl_Hash_Blake2b_Simd256_update_last(rem_len,
     wv1,
     s0,
+    false,
     FStar_UInt128_add(FStar_UInt128_uint64_to_uint128((uint64_t)128U),
       FStar_UInt128_uint64_to_uint128((uint64_t)full_blocks_len)),
     rem_len,
diff --git a/src/msvc/Hacl_HMAC_Blake2s_128.c b/src/msvc/Hacl_HMAC_Blake2s_128.c
index bf2033a8..f9fa97e6 100644
--- a/src/msvc/Hacl_HMAC_Blake2s_128.c
+++ b/src/msvc/Hacl_HMAC_Blake2s_128.c
@@ -92,7 +92,7 @@ Hacl_HMAC_Blake2s_128_compute_blake2s_128(
   if (data_len == 0U)
   {
     KRML_PRE_ALIGN(16) Lib_IntVector_Intrinsics_vec128 wv[4U] KRML_POST_ALIGN(16) = { 0U };
-    Hacl_Hash_Blake2s_Simd128_update_last(64U, wv, s0, 0ULL, 64U, ipad);
+    Hacl_Hash_Blake2s_Simd128_update_last(64U, wv, s0, false, 0ULL, 64U, ipad);
   }
   else
   {
@@ -127,6 +127,7 @@ Hacl_HMAC_Blake2s_128_compute_blake2s_128(
     Hacl_Hash_Blake2s_Simd128_update_last(rem_len,
       wv1,
       s0,
+      false,
       (uint64_t)64U + (uint64_t)full_blocks_len,
       rem_len,
       rem);
@@ -165,6 +166,7 @@ Hacl_HMAC_Blake2s_128_compute_blake2s_128(
   Hacl_Hash_Blake2s_Simd128_update_last(rem_len,
     wv1,
     s0,
+    false,
     (uint64_t)64U + (uint64_t)full_blocks_len,
     rem_len,
     rem);
diff --git a/src/msvc/Hacl_Hash_Blake2b.c b/src/msvc/Hacl_Hash_Blake2b.c
index d490a1a5..e13f16fd 100644
--- a/src/msvc/Hacl_Hash_Blake2b.c
+++ b/src/msvc/Hacl_Hash_Blake2b.c
@@ -29,7 +29,14 @@
 #include "lib_memzero0.h"
 
 static void
-update_block(uint64_t *wv, uint64_t *hash, bool flag, FStar_UInt128_uint128 totlen, uint8_t *d)
+update_block(
+  uint64_t *wv,
+  uint64_t *hash,
+  bool flag,
+  bool last_node,
+  FStar_UInt128_uint128 totlen,
+  uint8_t *d
+)
 {
   uint64_t m_w[16U] = { 0U };
   KRML_MAYBE_FOR16(i,
@@ -52,7 +59,15 @@ update_block(uint64_t *wv, uint64_t *hash, bool flag, FStar_UInt128_uint128 totl
   {
     wv_14 = 0ULL;
   }
-  uint64_t wv_15 = 0ULL;
+  uint64_t wv_15;
+  if (last_node)
+  {
+    wv_15 = 0xFFFFFFFFFFFFFFFFULL;
+  }
+  else
+  {
+    wv_15 = 0ULL;
+  }
   mask[0U] = FStar_UInt128_uint128_to_uint64(totlen);
   mask[1U] = FStar_UInt128_uint128_to_uint64(FStar_UInt128_shift_right(totlen, 64U));
   mask[2U] = wv_14;
@@ -647,11 +662,11 @@ static void update_key(uint64_t *wv, uint64_t *hash, uint32_t kk, uint8_t *k, ui
   memcpy(b, k, kk * sizeof (uint8_t));
   if (ll == 0U)
   {
-    update_block(wv, hash, true, lb, b);
+    update_block(wv, hash, true, false, lb, b);
   }
   else
   {
-    update_block(wv, hash, false, lb, b);
+    update_block(wv, hash, false, false, lb, b);
   }
   Lib_Memzero0_memzero(b, 128U, uint8_t, void *);
 }
@@ -674,7 +689,7 @@ Hacl_Hash_Blake2b_update_multi(
       FStar_UInt128_add_mod(prev,
         FStar_UInt128_uint64_to_uint128((uint64_t)((i + 1U) * 128U)));
     uint8_t *b = blocks + i * 128U;
-    update_block(wv, hash, false, totlen, b);
+    update_block(wv, hash, false, false, totlen, b);
   }
 }
 
@@ -683,6 +698,7 @@ Hacl_Hash_Blake2b_update_last(
   uint32_t len,
   uint64_t *wv,
   uint64_t *hash,
+  bool last_node,
   FStar_UInt128_uint128 prev,
   uint32_t rem,
   uint8_t *d
@@ -693,7 +709,7 @@ Hacl_Hash_Blake2b_update_last(
   memcpy(b, last, rem * sizeof (uint8_t));
   FStar_UInt128_uint128
   totlen = FStar_UInt128_add_mod(prev, FStar_UInt128_uint64_to_uint128((uint64_t)len));
-  update_block(wv, hash, true, totlen, b);
+  update_block(wv, hash, true, last_node, totlen, b);
   Lib_Memzero0_memzero(b, 128U, uint8_t, void *);
 }
 
@@ -727,7 +743,7 @@ update_blocks(
     rem = rem0;
   }
   Hacl_Hash_Blake2b_update_multi(len, wv, hash, prev, blocks, nb);
-  Hacl_Hash_Blake2b_update_last(len, wv, hash, prev, rem, blocks);
+  Hacl_Hash_Blake2b_update_last(len, wv, hash, false, prev, rem, blocks);
 }
 
 static inline void
@@ -762,16 +778,19 @@ void Hacl_Hash_Blake2b_finish(uint32_t nn, uint8_t *output, uint64_t *hash)
 }
 
 static Hacl_Hash_Blake2b_state_t
-*malloc_raw(
-  Hacl_Hash_Blake2b_index kk,
-  K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_ key
-)
+*malloc_raw(Hacl_Hash_Blake2b_index kk, Hacl_Hash_Blake2b_params_and_key key)
 {
   uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC(128U, sizeof (uint8_t));
   uint64_t *wv = (uint64_t *)KRML_HOST_CALLOC(16U, sizeof (uint64_t));
   uint64_t *b = (uint64_t *)KRML_HOST_CALLOC(16U, sizeof (uint64_t));
   Hacl_Hash_Blake2b_block_state_t
-  block_state = { .fst = kk.key_length, .snd = kk.digest_length, .thd = { .fst = wv, .snd = b } };
+  block_state =
+    {
+      .fst = kk.key_length,
+      .snd = kk.digest_length,
+      .thd = kk.last_node,
+      .f3 = { .fst = wv, .snd = b }
+    };
   uint8_t kk10 = kk.key_length;
   uint32_t ite;
   if (kk10 != 0U)
@@ -790,7 +809,8 @@ static Hacl_Hash_Blake2b_state_t
   Hacl_Hash_Blake2b_blake2_params *p1 = key.fst;
   uint8_t kk1 = p1->key_length;
   uint8_t nn = p1->digest_length;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
+  bool last_node = block_state.thd;
+  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint32_t kk2 = (uint32_t)i.key_length;
   uint8_t *k_1 = key.snd;
   if (!(kk2 == 0U))
@@ -800,7 +820,7 @@ static Hacl_Hash_Blake2b_state_t
     memcpy(buf, k_1, kk2 * sizeof (uint8_t));
   }
   Hacl_Hash_Blake2b_blake2_params pv = p1[0U];
-  init_with_params(block_state.thd.snd, pv);
+  init_with_params(block_state.f3.snd, pv);
   return p;
 }
 
@@ -820,14 +840,16 @@ The caller must satisfy the following requirements.
 
 */
 Hacl_Hash_Blake2b_state_t
-*Hacl_Hash_Blake2b_malloc_with_params_and_key(Hacl_Hash_Blake2b_blake2_params *p, uint8_t *k)
+*Hacl_Hash_Blake2b_malloc_with_params_and_key(
+  Hacl_Hash_Blake2b_blake2_params *p,
+  bool last_node,
+  uint8_t *k
+)
 {
   Hacl_Hash_Blake2b_blake2_params pv = p[0U];
   Hacl_Hash_Blake2b_index
-  i1 = { .key_length = pv.key_length, .digest_length = pv.digest_length };
-  return
-    malloc_raw(i1,
-      ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = p, .snd = k }));
+  i1 = { .key_length = pv.key_length, .digest_length = pv.digest_length, .last_node = last_node };
+  return malloc_raw(i1, ((Hacl_Hash_Blake2b_params_and_key){ .fst = p, .snd = k }));
 }
 
 /**
@@ -844,7 +866,7 @@ The caller must satisfy the following requirements.
 Hacl_Hash_Blake2b_state_t *Hacl_Hash_Blake2b_malloc_with_key(uint8_t *k, uint8_t kk)
 {
   uint8_t nn = 64U;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk, .digest_length = nn };
+  Hacl_Hash_Blake2b_index i = { .key_length = kk, .digest_length = nn, .last_node = false };
   uint8_t salt[16U] = { 0U };
   uint8_t personal[16U] = { 0U };
   Hacl_Hash_Blake2b_blake2_params
@@ -855,7 +877,7 @@ Hacl_Hash_Blake2b_state_t *Hacl_Hash_Blake2b_malloc_with_key(uint8_t *k, uint8_t
       .personal = personal
     };
   Hacl_Hash_Blake2b_blake2_params p0 = p;
-  Hacl_Hash_Blake2b_state_t *s = Hacl_Hash_Blake2b_malloc_with_params_and_key(&p0, k);
+  Hacl_Hash_Blake2b_state_t *s = Hacl_Hash_Blake2b_malloc_with_params_and_key(&p0, false, k);
   return s;
 }
 
@@ -872,28 +894,30 @@ Hacl_Hash_Blake2b_state_t *Hacl_Hash_Blake2b_malloc(void)
 static Hacl_Hash_Blake2b_index index_of_state(Hacl_Hash_Blake2b_state_t *s)
 {
   Hacl_Hash_Blake2b_block_state_t block_state = (*s).block_state;
+  bool last_node = block_state.thd;
   uint8_t nn = block_state.snd;
   uint8_t kk1 = block_state.fst;
-  return ((Hacl_Hash_Blake2b_index){ .key_length = kk1, .digest_length = nn });
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk1, .digest_length = nn, .last_node = last_node });
 }
 
-static void
-reset_raw(
-  Hacl_Hash_Blake2b_state_t *state,
-  K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_ key
-)
+static void reset_raw(Hacl_Hash_Blake2b_state_t *state, Hacl_Hash_Blake2b_params_and_key key)
 {
   Hacl_Hash_Blake2b_state_t scrut = *state;
   uint8_t *buf = scrut.buf;
   Hacl_Hash_Blake2b_block_state_t block_state = scrut.block_state;
+  bool last_node0 = block_state.thd;
   uint8_t nn0 = block_state.snd;
   uint8_t kk10 = block_state.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk10, .digest_length = nn0 };
+  Hacl_Hash_Blake2b_index
+  i = { .key_length = kk10, .digest_length = nn0, .last_node = last_node0 };
   KRML_MAYBE_UNUSED_VAR(i);
   Hacl_Hash_Blake2b_blake2_params *p = key.fst;
   uint8_t kk1 = p->key_length;
   uint8_t nn = p->digest_length;
-  Hacl_Hash_Blake2b_index i1 = { .key_length = kk1, .digest_length = nn };
+  bool last_node = block_state.thd;
+  Hacl_Hash_Blake2b_index
+  i1 = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint32_t kk2 = (uint32_t)i1.key_length;
   uint8_t *k_1 = key.snd;
   if (!(kk2 == 0U))
@@ -903,7 +927,7 @@ reset_raw(
     memcpy(buf, k_1, kk2 * sizeof (uint8_t));
   }
   Hacl_Hash_Blake2b_blake2_params pv = p[0U];
-  init_with_params(block_state.thd.snd, pv);
+  init_with_params(block_state.f3.snd, pv);
   uint8_t kk11 = i.key_length;
   uint32_t ite;
   if (kk11 != 0U)
@@ -921,7 +945,7 @@ reset_raw(
 
 /**
  General-purpose re-initialization function with parameters and
-key. You cannot change digest_length or key_length, meaning those values in
+key. You cannot change digest_length, key_length, or last_node, meaning those values in
 the parameters object must be the same as originally decided via one of the
 malloc functions. All other values of the parameter can be changed. The behavior
 is unspecified if you violate this precondition.
@@ -934,7 +958,7 @@ Hacl_Hash_Blake2b_reset_with_key_and_params(
 )
 {
   index_of_state(s);
-  reset_raw(s, ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = p, .snd = k }));
+  reset_raw(s, ((Hacl_Hash_Blake2b_params_and_key){ .fst = p, .snd = k }));
 }
 
 /**
@@ -957,7 +981,7 @@ void Hacl_Hash_Blake2b_reset_with_key(Hacl_Hash_Blake2b_state_t *s, uint8_t *k)
       .personal = personal
     };
   Hacl_Hash_Blake2b_blake2_params p0 = p;
-  reset_raw(s, ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = &p0, .snd = k }));
+  reset_raw(s, ((Hacl_Hash_Blake2b_params_and_key){ .fst = &p0, .snd = k }));
 }
 
 /**
@@ -1040,7 +1064,7 @@ Hacl_Hash_Blake2b_update(Hacl_Hash_Blake2b_state_t *state, uint8_t *chunk, uint3
     if (!(sz1 == 0U))
     {
       uint64_t prevlen = total_len1 - (uint64_t)sz1;
-      K____uint64_t___uint64_t_ acc = block_state1.thd;
+      K____uint64_t___uint64_t_ acc = block_state1.f3;
       uint64_t *wv = acc.fst;
       uint64_t *hash = acc.snd;
       uint32_t nb = 1U;
@@ -1065,7 +1089,7 @@ Hacl_Hash_Blake2b_update(Hacl_Hash_Blake2b_state_t *state, uint8_t *chunk, uint3
     uint32_t data2_len = chunk_len - data1_len;
     uint8_t *data1 = chunk;
     uint8_t *data2 = chunk + data1_len;
-    K____uint64_t___uint64_t_ acc = block_state1.thd;
+    K____uint64_t___uint64_t_ acc = block_state1.f3;
     uint64_t *wv = acc.fst;
     uint64_t *hash = acc.snd;
     uint32_t nb = data1_len / 128U;
@@ -1133,7 +1157,7 @@ Hacl_Hash_Blake2b_update(Hacl_Hash_Blake2b_state_t *state, uint8_t *chunk, uint3
     if (!(sz1 == 0U))
     {
       uint64_t prevlen = total_len1 - (uint64_t)sz1;
-      K____uint64_t___uint64_t_ acc = block_state1.thd;
+      K____uint64_t___uint64_t_ acc = block_state1.f3;
       uint64_t *wv = acc.fst;
       uint64_t *hash = acc.snd;
       uint32_t nb = 1U;
@@ -1159,7 +1183,7 @@ Hacl_Hash_Blake2b_update(Hacl_Hash_Blake2b_state_t *state, uint8_t *chunk, uint3
     uint32_t data2_len = chunk_len - diff - data1_len;
     uint8_t *data1 = chunk2;
     uint8_t *data2 = chunk2 + data1_len;
-    K____uint64_t___uint64_t_ acc = block_state1.thd;
+    K____uint64_t___uint64_t_ acc = block_state1.f3;
     uint64_t *wv = acc.fst;
     uint64_t *hash = acc.snd;
     uint32_t nb = data1_len / 128U;
@@ -1190,16 +1214,20 @@ at least `digest_length` bytes, where `digest_length` was determined by your
 choice of `malloc` function. Concretely, if you used `malloc` or
 `malloc_with_key`, then the expected length is 32 for S, or 64 for B (default
 digest length). If you used `malloc_with_params_and_key`, then the expected
-length is whatever you chose for the `digest_length` field of your
-parameters.
+length is whatever you chose for the `digest_length` field of your parameters.
+For convenience, this function returns `digest_length`. When in doubt, callers
+can pass an array of size HACL_BLAKE2B_32_OUT_BYTES, then use the return value
+to see how many bytes were actually written.
 */
-void Hacl_Hash_Blake2b_digest(Hacl_Hash_Blake2b_state_t *state, uint8_t *output)
+uint8_t Hacl_Hash_Blake2b_digest(Hacl_Hash_Blake2b_state_t *s, uint8_t *dst)
 {
-  Hacl_Hash_Blake2b_block_state_t block_state0 = (*state).block_state;
-  uint8_t nn = block_state0.snd;
-  uint8_t kk1 = block_state0.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
-  Hacl_Hash_Blake2b_state_t scrut = *state;
+  Hacl_Hash_Blake2b_block_state_t block_state0 = (*s).block_state;
+  bool last_node0 = block_state0.thd;
+  uint8_t nn0 = block_state0.snd;
+  uint8_t kk0 = block_state0.fst;
+  Hacl_Hash_Blake2b_index
+  i1 = { .key_length = kk0, .digest_length = nn0, .last_node = last_node0 };
+  Hacl_Hash_Blake2b_state_t scrut = *s;
   Hacl_Hash_Blake2b_block_state_t block_state = scrut.block_state;
   uint8_t *buf_ = scrut.buf;
   uint64_t total_len = scrut.total_len;
@@ -1217,9 +1245,14 @@ void Hacl_Hash_Blake2b_digest(Hacl_Hash_Blake2b_state_t *state, uint8_t *output)
   uint64_t b[16U] = { 0U };
   Hacl_Hash_Blake2b_block_state_t
   tmp_block_state =
-    { .fst = i.key_length, .snd = i.digest_length, .thd = { .fst = wv0, .snd = b } };
-  uint64_t *src_b = block_state.thd.snd;
-  uint64_t *dst_b = tmp_block_state.thd.snd;
+    {
+      .fst = i1.key_length,
+      .snd = i1.digest_length,
+      .thd = i1.last_node,
+      .f3 = { .fst = wv0, .snd = b }
+    };
+  uint64_t *src_b = block_state.f3.snd;
+  uint64_t *dst_b = tmp_block_state.f3.snd;
   memcpy(dst_b, src_b, 16U * sizeof (uint64_t));
   uint64_t prev_len = total_len - (uint64_t)r;
   uint32_t ite;
@@ -1233,7 +1266,7 @@ void Hacl_Hash_Blake2b_digest(Hacl_Hash_Blake2b_state_t *state, uint8_t *output)
   }
   uint8_t *buf_last = buf_1 + r - ite;
   uint8_t *buf_multi = buf_1;
-  K____uint64_t___uint64_t_ acc0 = tmp_block_state.thd;
+  K____uint64_t___uint64_t_ acc0 = tmp_block_state.f3;
   uint64_t *wv1 = acc0.fst;
   uint64_t *hash0 = acc0.snd;
   uint32_t nb = 0U;
@@ -1244,17 +1277,35 @@ void Hacl_Hash_Blake2b_digest(Hacl_Hash_Blake2b_state_t *state, uint8_t *output)
     buf_multi,
     nb);
   uint64_t prev_len_last = total_len - (uint64_t)r;
-  K____uint64_t___uint64_t_ acc = tmp_block_state.thd;
+  K____uint64_t___uint64_t_ acc = tmp_block_state.f3;
+  bool last_node1 = tmp_block_state.thd;
   uint64_t *wv = acc.fst;
   uint64_t *hash = acc.snd;
   Hacl_Hash_Blake2b_update_last(r,
     wv,
     hash,
+    last_node1,
     FStar_UInt128_uint64_to_uint128(prev_len_last),
     r,
     buf_last);
-  uint8_t nn0 = tmp_block_state.snd;
-  Hacl_Hash_Blake2b_finish((uint32_t)nn0, output, tmp_block_state.thd.snd);
+  uint8_t nn1 = tmp_block_state.snd;
+  Hacl_Hash_Blake2b_finish((uint32_t)nn1, dst, tmp_block_state.f3.snd);
+  Hacl_Hash_Blake2b_block_state_t block_state1 = (*s).block_state;
+  bool last_node = block_state1.thd;
+  uint8_t nn = block_state1.snd;
+  uint8_t kk = block_state1.fst;
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk, .digest_length = nn, .last_node = last_node }).digest_length;
+}
+
+Hacl_Hash_Blake2b_index Hacl_Hash_Blake2b_info(Hacl_Hash_Blake2b_state_t *s)
+{
+  Hacl_Hash_Blake2b_block_state_t block_state = (*s).block_state;
+  bool last_node = block_state.thd;
+  uint8_t nn = block_state.snd;
+  uint8_t kk = block_state.fst;
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk, .digest_length = nn, .last_node = last_node });
 }
 
 /**
@@ -1265,8 +1316,8 @@ void Hacl_Hash_Blake2b_free(Hacl_Hash_Blake2b_state_t *state)
   Hacl_Hash_Blake2b_state_t scrut = *state;
   uint8_t *buf = scrut.buf;
   Hacl_Hash_Blake2b_block_state_t block_state = scrut.block_state;
-  uint64_t *b = block_state.thd.snd;
-  uint64_t *wv = block_state.thd.fst;
+  uint64_t *b = block_state.f3.snd;
+  uint64_t *wv = block_state.f3.fst;
   KRML_HOST_FREE(wv);
   KRML_HOST_FREE(b);
   KRML_HOST_FREE(buf);
@@ -1282,17 +1333,24 @@ Hacl_Hash_Blake2b_state_t *Hacl_Hash_Blake2b_copy(Hacl_Hash_Blake2b_state_t *sta
   Hacl_Hash_Blake2b_block_state_t block_state0 = scrut.block_state;
   uint8_t *buf0 = scrut.buf;
   uint64_t total_len0 = scrut.total_len;
+  bool last_node = block_state0.thd;
   uint8_t nn = block_state0.snd;
   uint8_t kk1 = block_state0.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
+  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC(128U, sizeof (uint8_t));
   memcpy(buf, buf0, 128U * sizeof (uint8_t));
   uint64_t *wv = (uint64_t *)KRML_HOST_CALLOC(16U, sizeof (uint64_t));
   uint64_t *b = (uint64_t *)KRML_HOST_CALLOC(16U, sizeof (uint64_t));
   Hacl_Hash_Blake2b_block_state_t
-  block_state = { .fst = i.key_length, .snd = i.digest_length, .thd = { .fst = wv, .snd = b } };
-  uint64_t *src_b = block_state0.thd.snd;
-  uint64_t *dst_b = block_state.thd.snd;
+  block_state =
+    {
+      .fst = i.key_length,
+      .snd = i.digest_length,
+      .thd = i.last_node,
+      .f3 = { .fst = wv, .snd = b }
+    };
+  uint64_t *src_b = block_state0.f3.snd;
+  uint64_t *dst_b = block_state.f3.snd;
   memcpy(dst_b, src_b, 16U * sizeof (uint64_t));
   Hacl_Hash_Blake2b_state_t
   s = { .block_state = block_state, .buf = buf, .total_len = total_len0 };
@@ -1335,10 +1393,10 @@ Hacl_Hash_Blake2b_hash_with_key(
 Write the BLAKE2b digest of message `input` using key `key` and
 parameters `params` into `output`. The `key` array must be of length
 `params.key_length`. The `output` array must be of length
-`params.digest_length`. 
+`params.digest_length`.
 */
 void
-Hacl_Hash_Blake2b_hash_with_key_and_paramas(
+Hacl_Hash_Blake2b_hash_with_key_and_params(
   uint8_t *output,
   uint8_t *input,
   uint32_t input_len,
diff --git a/src/msvc/Hacl_Hash_Blake2b_Simd256.c b/src/msvc/Hacl_Hash_Blake2b_Simd256.c
index 0afd93bc..35608aea 100644
--- a/src/msvc/Hacl_Hash_Blake2b_Simd256.c
+++ b/src/msvc/Hacl_Hash_Blake2b_Simd256.c
@@ -34,6 +34,7 @@ update_block(
   Lib_IntVector_Intrinsics_vec256 *wv,
   Lib_IntVector_Intrinsics_vec256 *hash,
   bool flag,
+  bool last_node,
   FStar_UInt128_uint128 totlen,
   uint8_t *d
 )
@@ -59,7 +60,15 @@ update_block(
   {
     wv_14 = 0ULL;
   }
-  uint64_t wv_15 = 0ULL;
+  uint64_t wv_15;
+  if (last_node)
+  {
+    wv_15 = 0xFFFFFFFFFFFFFFFFULL;
+  }
+  else
+  {
+    wv_15 = 0ULL;
+  }
   mask =
     Lib_IntVector_Intrinsics_vec256_load64s(FStar_UInt128_uint128_to_uint64(totlen),
       FStar_UInt128_uint128_to_uint64(FStar_UInt128_shift_right(totlen, 64U)),
@@ -372,11 +381,11 @@ update_key(
   memcpy(b, k, kk * sizeof (uint8_t));
   if (ll == 0U)
   {
-    update_block(wv, hash, true, lb, b);
+    update_block(wv, hash, true, false, lb, b);
   }
   else
   {
-    update_block(wv, hash, false, lb, b);
+    update_block(wv, hash, false, false, lb, b);
   }
   Lib_Memzero0_memzero(b, 128U, uint8_t, void *);
 }
@@ -399,7 +408,7 @@ Hacl_Hash_Blake2b_Simd256_update_multi(
       FStar_UInt128_add_mod(prev,
         FStar_UInt128_uint64_to_uint128((uint64_t)((i + 1U) * 128U)));
     uint8_t *b = blocks + i * 128U;
-    update_block(wv, hash, false, totlen, b);
+    update_block(wv, hash, false, false, totlen, b);
   }
 }
 
@@ -408,6 +417,7 @@ Hacl_Hash_Blake2b_Simd256_update_last(
   uint32_t len,
   Lib_IntVector_Intrinsics_vec256 *wv,
   Lib_IntVector_Intrinsics_vec256 *hash,
+  bool last_node,
   FStar_UInt128_uint128 prev,
   uint32_t rem,
   uint8_t *d
@@ -418,7 +428,7 @@ Hacl_Hash_Blake2b_Simd256_update_last(
   memcpy(b, last, rem * sizeof (uint8_t));
   FStar_UInt128_uint128
   totlen = FStar_UInt128_add_mod(prev, FStar_UInt128_uint64_to_uint128((uint64_t)len));
-  update_block(wv, hash, true, totlen, b);
+  update_block(wv, hash, true, last_node, totlen, b);
   Lib_Memzero0_memzero(b, 128U, uint8_t, void *);
 }
 
@@ -452,7 +462,7 @@ update_blocks(
     rem = rem0;
   }
   Hacl_Hash_Blake2b_Simd256_update_multi(len, wv, hash, prev, blocks, nb);
-  Hacl_Hash_Blake2b_Simd256_update_last(len, wv, hash, prev, rem, blocks);
+  Hacl_Hash_Blake2b_Simd256_update_last(len, wv, hash, false, prev, rem, blocks);
 }
 
 static inline void
@@ -593,10 +603,7 @@ Lib_IntVector_Intrinsics_vec256 *Hacl_Hash_Blake2b_Simd256_malloc_with_key(void)
 }
 
 static Hacl_Hash_Blake2b_Simd256_state_t
-*malloc_raw(
-  Hacl_Hash_Blake2b_index kk,
-  K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_ key
-)
+*malloc_raw(Hacl_Hash_Blake2b_index kk, Hacl_Hash_Blake2b_params_and_key key)
 {
   uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC(128U, sizeof (uint8_t));
   Lib_IntVector_Intrinsics_vec256
@@ -610,7 +617,13 @@ static Hacl_Hash_Blake2b_Simd256_state_t
       sizeof (Lib_IntVector_Intrinsics_vec256) * 4U);
   memset(b, 0U, 4U * sizeof (Lib_IntVector_Intrinsics_vec256));
   Hacl_Hash_Blake2b_Simd256_block_state_t
-  block_state = { .fst = kk.key_length, .snd = kk.digest_length, .thd = { .fst = wv, .snd = b } };
+  block_state =
+    {
+      .fst = kk.key_length,
+      .snd = kk.digest_length,
+      .thd = kk.last_node,
+      .f3 = { .fst = wv, .snd = b }
+    };
   uint8_t kk10 = kk.key_length;
   uint32_t ite;
   if (kk10 != 0U)
@@ -632,7 +645,8 @@ static Hacl_Hash_Blake2b_Simd256_state_t
   Hacl_Hash_Blake2b_blake2_params *p1 = key.fst;
   uint8_t kk1 = p1->key_length;
   uint8_t nn = p1->digest_length;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
+  bool last_node = block_state.thd;
+  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint32_t kk2 = (uint32_t)i.key_length;
   uint8_t *k_1 = key.snd;
   if (!(kk2 == 0U))
@@ -642,42 +656,56 @@ static Hacl_Hash_Blake2b_Simd256_state_t
     memcpy(buf, k_1, kk2 * sizeof (uint8_t));
   }
   Hacl_Hash_Blake2b_blake2_params pv = p1[0U];
-  init_with_params(block_state.thd.snd, pv);
+  init_with_params(block_state.f3.snd, pv);
   return p;
 }
 
 /**
- State allocation function when there are parameters and a key. The
-length of the key k MUST match the value of the field key_length in the
-parameters. Furthermore, there is a static (not dynamically checked) requirement
-that key_length does not exceed max_key (256 for S, 64 for B).)
+ General-purpose allocation function that gives control over all
+Blake2 parameters, including the key. Further resettings of the state SHALL be
+done with `reset_with_params_and_key`, and SHALL feature the exact same values
+for the `key_length` and `digest_length` fields as passed here. In other words,
+once you commit to a digest and key length, the only way to change these
+parameters is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The length of the key k MUST match the value of the field key_length in the
+  parameters.
+- The key_length must not exceed 256 for S, 64 for B.
+- The digest_length must not exceed 256 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2b_Simd256_state_t
 *Hacl_Hash_Blake2b_Simd256_malloc_with_params_and_key(
   Hacl_Hash_Blake2b_blake2_params *p,
+  bool last_node,
   uint8_t *k
 )
 {
   Hacl_Hash_Blake2b_blake2_params pv = p[0U];
   Hacl_Hash_Blake2b_index
-  i1 = { .key_length = pv.key_length, .digest_length = pv.digest_length };
-  return
-    malloc_raw(i1,
-      ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = p, .snd = k }));
+  i1 = { .key_length = pv.key_length, .digest_length = pv.digest_length, .last_node = last_node };
+  return malloc_raw(i1, ((Hacl_Hash_Blake2b_params_and_key){ .fst = p, .snd = k }));
 }
 
 /**
- State allocation function when there is just a custom key. All
-other parameters are set to their respective default values, meaning the output
-length is the maximum allowed output (256 for S, 64 for B).
+ Specialized allocation function that picks default values for all
+parameters, except for the key_length. Further resettings of the state SHALL be
+done with `reset_with_key`, and SHALL feature the exact same key length `kk` as
+passed here. In other words, once you commit to a key length, the only way to
+change this parameter is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The key_length must not exceed 256 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2b_Simd256_state_t
 *Hacl_Hash_Blake2b_Simd256_malloc_with_key0(uint8_t *k, uint8_t kk)
 {
   uint8_t nn = 64U;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk, .digest_length = nn };
-  uint8_t *salt = (uint8_t *)KRML_HOST_CALLOC(16U, sizeof (uint8_t));
-  uint8_t *personal = (uint8_t *)KRML_HOST_CALLOC(16U, sizeof (uint8_t));
+  Hacl_Hash_Blake2b_index i = { .key_length = kk, .digest_length = nn, .last_node = false };
+  uint8_t salt[16U] = { 0U };
+  uint8_t personal[16U] = { 0U };
   Hacl_Hash_Blake2b_blake2_params
   p =
     {
@@ -685,21 +713,16 @@ Hacl_Hash_Blake2b_Simd256_state_t
       .leaf_length = 0U, .node_offset = 0ULL, .node_depth = 0U, .inner_length = 0U, .salt = salt,
       .personal = personal
     };
-  Hacl_Hash_Blake2b_blake2_params
-  *p0 =
-    (Hacl_Hash_Blake2b_blake2_params *)KRML_HOST_MALLOC(sizeof (Hacl_Hash_Blake2b_blake2_params));
-  p0[0U] = p;
+  Hacl_Hash_Blake2b_blake2_params p0 = p;
   Hacl_Hash_Blake2b_Simd256_state_t
-  *s = Hacl_Hash_Blake2b_Simd256_malloc_with_params_and_key(p0, k);
-  Hacl_Hash_Blake2b_blake2_params p1 = p0[0U];
-  KRML_HOST_FREE(p1.salt);
-  KRML_HOST_FREE(p1.personal);
-  KRML_HOST_FREE(p0);
+  *s = Hacl_Hash_Blake2b_Simd256_malloc_with_params_and_key(&p0, false, k);
   return s;
 }
 
 /**
-  State allocation function when there is no key
+ Specialized allocation function that picks default values for all
+parameters, and has no key. Effectively, this is what you want if you intend to
+use Blake2 as a hash function. Further resettings of the state SHALL be done with `reset`.
 */
 Hacl_Hash_Blake2b_Simd256_state_t *Hacl_Hash_Blake2b_Simd256_malloc(void)
 {
@@ -709,28 +732,31 @@ Hacl_Hash_Blake2b_Simd256_state_t *Hacl_Hash_Blake2b_Simd256_malloc(void)
 static Hacl_Hash_Blake2b_index index_of_state(Hacl_Hash_Blake2b_Simd256_state_t *s)
 {
   Hacl_Hash_Blake2b_Simd256_block_state_t block_state = (*s).block_state;
+  bool last_node = block_state.thd;
   uint8_t nn = block_state.snd;
   uint8_t kk1 = block_state.fst;
-  return ((Hacl_Hash_Blake2b_index){ .key_length = kk1, .digest_length = nn });
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk1, .digest_length = nn, .last_node = last_node });
 }
 
 static void
-reset_raw(
-  Hacl_Hash_Blake2b_Simd256_state_t *state,
-  K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_ key
-)
+reset_raw(Hacl_Hash_Blake2b_Simd256_state_t *state, Hacl_Hash_Blake2b_params_and_key key)
 {
   Hacl_Hash_Blake2b_Simd256_state_t scrut = *state;
   uint8_t *buf = scrut.buf;
   Hacl_Hash_Blake2b_Simd256_block_state_t block_state = scrut.block_state;
+  bool last_node0 = block_state.thd;
   uint8_t nn0 = block_state.snd;
   uint8_t kk10 = block_state.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk10, .digest_length = nn0 };
+  Hacl_Hash_Blake2b_index
+  i = { .key_length = kk10, .digest_length = nn0, .last_node = last_node0 };
   KRML_MAYBE_UNUSED_VAR(i);
   Hacl_Hash_Blake2b_blake2_params *p = key.fst;
   uint8_t kk1 = p->key_length;
   uint8_t nn = p->digest_length;
-  Hacl_Hash_Blake2b_index i1 = { .key_length = kk1, .digest_length = nn };
+  bool last_node = block_state.thd;
+  Hacl_Hash_Blake2b_index
+  i1 = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint32_t kk2 = (uint32_t)i1.key_length;
   uint8_t *k_1 = key.snd;
   if (!(kk2 == 0U))
@@ -740,7 +766,7 @@ reset_raw(
     memcpy(buf, k_1, kk2 * sizeof (uint8_t));
   }
   Hacl_Hash_Blake2b_blake2_params pv = p[0U];
-  init_with_params(block_state.thd.snd, pv);
+  init_with_params(block_state.f3.snd, pv);
   uint8_t kk11 = i.key_length;
   uint32_t ite;
   if (kk11 != 0U)
@@ -757,9 +783,11 @@ reset_raw(
 }
 
 /**
- Re-initialization function. The reinitialization API is tricky --
-you MUST reuse the same original parameters for digest (output) length and key
-length.
+ General-purpose re-initialization function with parameters and
+key. You cannot change digest_length, key_length, or last_node, meaning those values in
+the parameters object must be the same as originally decided via one of the
+malloc functions. All other values of the parameter can be changed. The behavior
+is unspecified if you violate this precondition.
 */
 void
 Hacl_Hash_Blake2b_Simd256_reset_with_key_and_params(
@@ -769,14 +797,15 @@ Hacl_Hash_Blake2b_Simd256_reset_with_key_and_params(
 )
 {
   index_of_state(s);
-  reset_raw(s, ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = p, .snd = k }));
+  reset_raw(s, ((Hacl_Hash_Blake2b_params_and_key){ .fst = p, .snd = k }));
 }
 
 /**
- Re-initialization function when there is a key. Note that the key
-size is not allowed to change, which is why this function does not take a key
-length -- the key has to be same key size that was originally passed to
-`malloc_with_key`
+ Specialized-purpose re-initialization function with no parameters,
+and a key. The key length must be the same as originally decided via your choice
+of malloc function. All other parameters are reset to their default values. The
+original call to malloc MUST have set digest_length to the default value. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2b_Simd256_reset_with_key(Hacl_Hash_Blake2b_Simd256_state_t *s, uint8_t *k)
 {
@@ -791,11 +820,16 @@ void Hacl_Hash_Blake2b_Simd256_reset_with_key(Hacl_Hash_Blake2b_Simd256_state_t
       .personal = personal
     };
   Hacl_Hash_Blake2b_blake2_params p0 = p;
-  reset_raw(s, ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = &p0, .snd = k }));
+  reset_raw(s, ((Hacl_Hash_Blake2b_params_and_key){ .fst = &p0, .snd = k }));
 }
 
 /**
-  Re-initialization function when there is no key
+ Specialized-purpose re-initialization function with no parameters
+and no key. This is what you want if you intend to use Blake2 as a hash
+function. The key length and digest length must have been set to their
+respective default values via your choice of malloc function (always true if you
+used `malloc`). All other parameters are reset to their default values. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2b_Simd256_reset(Hacl_Hash_Blake2b_Simd256_state_t *s)
 {
@@ -803,7 +837,7 @@ void Hacl_Hash_Blake2b_Simd256_reset(Hacl_Hash_Blake2b_Simd256_state_t *s)
 }
 
 /**
-  Update function when there is no key; 0 = success, 1 = max length exceeded
+  Update function; 0 = success, 1 = max length exceeded
 */
 Hacl_Streaming_Types_error_code
 Hacl_Hash_Blake2b_Simd256_update(
@@ -873,8 +907,7 @@ Hacl_Hash_Blake2b_Simd256_update(
     if (!(sz1 == 0U))
     {
       uint64_t prevlen = total_len1 - (uint64_t)sz1;
-      K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_
-      acc = block_state1.thd;
+      K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_ acc = block_state1.f3;
       Lib_IntVector_Intrinsics_vec256 *wv = acc.fst;
       Lib_IntVector_Intrinsics_vec256 *hash = acc.snd;
       uint32_t nb = 1U;
@@ -899,7 +932,7 @@ Hacl_Hash_Blake2b_Simd256_update(
     uint32_t data2_len = chunk_len - data1_len;
     uint8_t *data1 = chunk;
     uint8_t *data2 = chunk + data1_len;
-    K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_ acc = block_state1.thd;
+    K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_ acc = block_state1.f3;
     Lib_IntVector_Intrinsics_vec256 *wv = acc.fst;
     Lib_IntVector_Intrinsics_vec256 *hash = acc.snd;
     uint32_t nb = data1_len / 128U;
@@ -967,8 +1000,7 @@ Hacl_Hash_Blake2b_Simd256_update(
     if (!(sz1 == 0U))
     {
       uint64_t prevlen = total_len1 - (uint64_t)sz1;
-      K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_
-      acc = block_state1.thd;
+      K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_ acc = block_state1.f3;
       Lib_IntVector_Intrinsics_vec256 *wv = acc.fst;
       Lib_IntVector_Intrinsics_vec256 *hash = acc.snd;
       uint32_t nb = 1U;
@@ -994,7 +1026,7 @@ Hacl_Hash_Blake2b_Simd256_update(
     uint32_t data2_len = chunk_len - diff - data1_len;
     uint8_t *data1 = chunk2;
     uint8_t *data2 = chunk2 + data1_len;
-    K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_ acc = block_state1.thd;
+    K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_ acc = block_state1.f3;
     Lib_IntVector_Intrinsics_vec256 *wv = acc.fst;
     Lib_IntVector_Intrinsics_vec256 *hash = acc.snd;
     uint32_t nb = data1_len / 128U;
@@ -1020,16 +1052,25 @@ Hacl_Hash_Blake2b_Simd256_update(
 }
 
 /**
-  Finish function when there is no key
+ Digest function. This function expects the `output` array to hold
+at least `digest_length` bytes, where `digest_length` was determined by your
+choice of `malloc` function. Concretely, if you used `malloc` or
+`malloc_with_key`, then the expected length is 256 for S, or 64 for B (default
+digest length). If you used `malloc_with_params_and_key`, then the expected
+length is whatever you chose for the `digest_length` field of your parameters.
+For convenience, this function returns `digest_length`. When in doubt, callers
+can pass an array of size HACL_BLAKE2B_256_OUT_BYTES, then use the return value
+to see how many bytes were actually written.
 */
-void
-Hacl_Hash_Blake2b_Simd256_digest(Hacl_Hash_Blake2b_Simd256_state_t *state, uint8_t *output)
+uint8_t Hacl_Hash_Blake2b_Simd256_digest(Hacl_Hash_Blake2b_Simd256_state_t *s, uint8_t *dst)
 {
-  Hacl_Hash_Blake2b_Simd256_block_state_t block_state0 = (*state).block_state;
-  uint8_t nn = block_state0.snd;
-  uint8_t kk1 = block_state0.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
-  Hacl_Hash_Blake2b_Simd256_state_t scrut = *state;
+  Hacl_Hash_Blake2b_Simd256_block_state_t block_state0 = (*s).block_state;
+  bool last_node0 = block_state0.thd;
+  uint8_t nn0 = block_state0.snd;
+  uint8_t kk0 = block_state0.fst;
+  Hacl_Hash_Blake2b_index
+  i1 = { .key_length = kk0, .digest_length = nn0, .last_node = last_node0 };
+  Hacl_Hash_Blake2b_Simd256_state_t scrut = *s;
   Hacl_Hash_Blake2b_Simd256_block_state_t block_state = scrut.block_state;
   uint8_t *buf_ = scrut.buf;
   uint64_t total_len = scrut.total_len;
@@ -1047,9 +1088,14 @@ Hacl_Hash_Blake2b_Simd256_digest(Hacl_Hash_Blake2b_Simd256_state_t *state, uint8
   KRML_PRE_ALIGN(32) Lib_IntVector_Intrinsics_vec256 b[4U] KRML_POST_ALIGN(32) = { 0U };
   Hacl_Hash_Blake2b_Simd256_block_state_t
   tmp_block_state =
-    { .fst = i.key_length, .snd = i.digest_length, .thd = { .fst = wv0, .snd = b } };
-  Lib_IntVector_Intrinsics_vec256 *src_b = block_state.thd.snd;
-  Lib_IntVector_Intrinsics_vec256 *dst_b = tmp_block_state.thd.snd;
+    {
+      .fst = i1.key_length,
+      .snd = i1.digest_length,
+      .thd = i1.last_node,
+      .f3 = { .fst = wv0, .snd = b }
+    };
+  Lib_IntVector_Intrinsics_vec256 *src_b = block_state.f3.snd;
+  Lib_IntVector_Intrinsics_vec256 *dst_b = tmp_block_state.f3.snd;
   memcpy(dst_b, src_b, 4U * sizeof (Lib_IntVector_Intrinsics_vec256));
   uint64_t prev_len = total_len - (uint64_t)r;
   uint32_t ite;
@@ -1064,7 +1110,7 @@ Hacl_Hash_Blake2b_Simd256_digest(Hacl_Hash_Blake2b_Simd256_state_t *state, uint8
   uint8_t *buf_last = buf_1 + r - ite;
   uint8_t *buf_multi = buf_1;
   K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_
-  acc0 = tmp_block_state.thd;
+  acc0 = tmp_block_state.f3;
   Lib_IntVector_Intrinsics_vec256 *wv1 = acc0.fst;
   Lib_IntVector_Intrinsics_vec256 *hash0 = acc0.snd;
   uint32_t nb = 0U;
@@ -1076,17 +1122,35 @@ Hacl_Hash_Blake2b_Simd256_digest(Hacl_Hash_Blake2b_Simd256_state_t *state, uint8
     nb);
   uint64_t prev_len_last = total_len - (uint64_t)r;
   K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_
-  acc = tmp_block_state.thd;
+  acc = tmp_block_state.f3;
+  bool last_node1 = tmp_block_state.thd;
   Lib_IntVector_Intrinsics_vec256 *wv = acc.fst;
   Lib_IntVector_Intrinsics_vec256 *hash = acc.snd;
   Hacl_Hash_Blake2b_Simd256_update_last(r,
     wv,
     hash,
+    last_node1,
     FStar_UInt128_uint64_to_uint128(prev_len_last),
     r,
     buf_last);
-  uint8_t nn0 = tmp_block_state.snd;
-  Hacl_Hash_Blake2b_Simd256_finish((uint32_t)nn0, output, tmp_block_state.thd.snd);
+  uint8_t nn1 = tmp_block_state.snd;
+  Hacl_Hash_Blake2b_Simd256_finish((uint32_t)nn1, dst, tmp_block_state.f3.snd);
+  Hacl_Hash_Blake2b_Simd256_block_state_t block_state1 = (*s).block_state;
+  bool last_node = block_state1.thd;
+  uint8_t nn = block_state1.snd;
+  uint8_t kk = block_state1.fst;
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk, .digest_length = nn, .last_node = last_node }).digest_length;
+}
+
+Hacl_Hash_Blake2b_index Hacl_Hash_Blake2b_Simd256_info(Hacl_Hash_Blake2b_Simd256_state_t *s)
+{
+  Hacl_Hash_Blake2b_Simd256_block_state_t block_state = (*s).block_state;
+  bool last_node = block_state.thd;
+  uint8_t nn = block_state.snd;
+  uint8_t kk = block_state.fst;
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk, .digest_length = nn, .last_node = last_node });
 }
 
 /**
@@ -1097,8 +1161,8 @@ void Hacl_Hash_Blake2b_Simd256_free(Hacl_Hash_Blake2b_Simd256_state_t *state)
   Hacl_Hash_Blake2b_Simd256_state_t scrut = *state;
   uint8_t *buf = scrut.buf;
   Hacl_Hash_Blake2b_Simd256_block_state_t block_state = scrut.block_state;
-  Lib_IntVector_Intrinsics_vec256 *b = block_state.thd.snd;
-  Lib_IntVector_Intrinsics_vec256 *wv = block_state.thd.fst;
+  Lib_IntVector_Intrinsics_vec256 *b = block_state.f3.snd;
+  Lib_IntVector_Intrinsics_vec256 *wv = block_state.f3.fst;
   KRML_ALIGNED_FREE(wv);
   KRML_ALIGNED_FREE(b);
   KRML_HOST_FREE(buf);
@@ -1106,7 +1170,7 @@ void Hacl_Hash_Blake2b_Simd256_free(Hacl_Hash_Blake2b_Simd256_state_t *state)
 }
 
 /**
-  Copying. The key length (or absence thereof) must match between source and destination.
+  Copying. This preserves all parameters.
 */
 Hacl_Hash_Blake2b_Simd256_state_t
 *Hacl_Hash_Blake2b_Simd256_copy(Hacl_Hash_Blake2b_Simd256_state_t *state)
@@ -1115,9 +1179,10 @@ Hacl_Hash_Blake2b_Simd256_state_t
   Hacl_Hash_Blake2b_Simd256_block_state_t block_state0 = scrut.block_state;
   uint8_t *buf0 = scrut.buf;
   uint64_t total_len0 = scrut.total_len;
+  bool last_node = block_state0.thd;
   uint8_t nn = block_state0.snd;
   uint8_t kk1 = block_state0.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
+  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC(128U, sizeof (uint8_t));
   memcpy(buf, buf0, 128U * sizeof (uint8_t));
   Lib_IntVector_Intrinsics_vec256
@@ -1131,9 +1196,15 @@ Hacl_Hash_Blake2b_Simd256_state_t
       sizeof (Lib_IntVector_Intrinsics_vec256) * 4U);
   memset(b, 0U, 4U * sizeof (Lib_IntVector_Intrinsics_vec256));
   Hacl_Hash_Blake2b_Simd256_block_state_t
-  block_state = { .fst = i.key_length, .snd = i.digest_length, .thd = { .fst = wv, .snd = b } };
-  Lib_IntVector_Intrinsics_vec256 *src_b = block_state0.thd.snd;
-  Lib_IntVector_Intrinsics_vec256 *dst_b = block_state.thd.snd;
+  block_state =
+    {
+      .fst = i.key_length,
+      .snd = i.digest_length,
+      .thd = i.last_node,
+      .f3 = { .fst = wv, .snd = b }
+    };
+  Lib_IntVector_Intrinsics_vec256 *src_b = block_state0.f3.snd;
+  Lib_IntVector_Intrinsics_vec256 *dst_b = block_state.f3.snd;
   memcpy(dst_b, src_b, 4U * sizeof (Lib_IntVector_Intrinsics_vec256));
   Hacl_Hash_Blake2b_Simd256_state_t
   s = { .block_state = block_state, .buf = buf, .total_len = total_len0 };
@@ -1175,8 +1246,14 @@ Hacl_Hash_Blake2b_Simd256_hash_with_key(
   Lib_Memzero0_memzero(b, 4U, Lib_IntVector_Intrinsics_vec256, void *);
 }
 
+/**
+Write the BLAKE2b digest of message `input` using key `key` and
+parameters `params` into `output`. The `key` array must be of length
+`params.key_length`. The `output` array must be of length
+`params.digest_length`.
+*/
 void
-Hacl_Hash_Blake2b_Simd256_hash_with_key_and_paramas(
+Hacl_Hash_Blake2b_Simd256_hash_with_key_and_params(
   uint8_t *output,
   uint8_t *input,
   uint32_t input_len,
diff --git a/src/msvc/Hacl_Hash_Blake2s.c b/src/msvc/Hacl_Hash_Blake2s.c
index 6e19d83d..167f38fb 100644
--- a/src/msvc/Hacl_Hash_Blake2s.c
+++ b/src/msvc/Hacl_Hash_Blake2s.c
@@ -30,7 +30,14 @@
 #include "lib_memzero0.h"
 
 static inline void
-update_block(uint32_t *wv, uint32_t *hash, bool flag, uint64_t totlen, uint8_t *d)
+update_block(
+  uint32_t *wv,
+  uint32_t *hash,
+  bool flag,
+  bool last_node,
+  uint64_t totlen,
+  uint8_t *d
+)
 {
   uint32_t m_w[16U] = { 0U };
   KRML_MAYBE_FOR16(i,
@@ -53,7 +60,15 @@ update_block(uint32_t *wv, uint32_t *hash, bool flag, uint64_t totlen, uint8_t *
   {
     wv_14 = 0U;
   }
-  uint32_t wv_15 = 0U;
+  uint32_t wv_15;
+  if (last_node)
+  {
+    wv_15 = 0xFFFFFFFFU;
+  }
+  else
+  {
+    wv_15 = 0U;
+  }
   mask[0U] = (uint32_t)totlen;
   mask[1U] = (uint32_t)(totlen >> 32U);
   mask[2U] = wv_14;
@@ -642,11 +657,11 @@ static void update_key(uint32_t *wv, uint32_t *hash, uint32_t kk, uint8_t *k, ui
   memcpy(b, k, kk * sizeof (uint8_t));
   if (ll == 0U)
   {
-    update_block(wv, hash, true, lb, b);
+    update_block(wv, hash, true, false, lb, b);
   }
   else
   {
-    update_block(wv, hash, false, lb, b);
+    update_block(wv, hash, false, false, lb, b);
   }
   Lib_Memzero0_memzero(b, 64U, uint8_t, void *);
 }
@@ -666,7 +681,7 @@ Hacl_Hash_Blake2s_update_multi(
   {
     uint64_t totlen = prev + (uint64_t)((i + 1U) * 64U);
     uint8_t *b = blocks + i * 64U;
-    update_block(wv, hash, false, totlen, b);
+    update_block(wv, hash, false, false, totlen, b);
   }
 }
 
@@ -675,6 +690,7 @@ Hacl_Hash_Blake2s_update_last(
   uint32_t len,
   uint32_t *wv,
   uint32_t *hash,
+  bool last_node,
   uint64_t prev,
   uint32_t rem,
   uint8_t *d
@@ -684,7 +700,7 @@ Hacl_Hash_Blake2s_update_last(
   uint8_t *last = d + len - rem;
   memcpy(b, last, rem * sizeof (uint8_t));
   uint64_t totlen = prev + (uint64_t)len;
-  update_block(wv, hash, true, totlen, b);
+  update_block(wv, hash, true, last_node, totlen, b);
   Lib_Memzero0_memzero(b, 64U, uint8_t, void *);
 }
 
@@ -712,7 +728,7 @@ update_blocks(uint32_t len, uint32_t *wv, uint32_t *hash, uint64_t prev, uint8_t
     rem = rem0;
   }
   Hacl_Hash_Blake2s_update_multi(len, wv, hash, prev, blocks, nb);
-  Hacl_Hash_Blake2s_update_last(len, wv, hash, prev, rem, blocks);
+  Hacl_Hash_Blake2s_update_last(len, wv, hash, false, prev, rem, blocks);
 }
 
 static inline void
@@ -747,16 +763,19 @@ void Hacl_Hash_Blake2s_finish(uint32_t nn, uint8_t *output, uint32_t *hash)
 }
 
 static Hacl_Hash_Blake2s_state_t
-*malloc_raw(
-  Hacl_Hash_Blake2b_index kk,
-  K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_ key
-)
+*malloc_raw(Hacl_Hash_Blake2b_index kk, Hacl_Hash_Blake2b_params_and_key key)
 {
   uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC(64U, sizeof (uint8_t));
   uint32_t *wv = (uint32_t *)KRML_HOST_CALLOC(16U, sizeof (uint32_t));
   uint32_t *b = (uint32_t *)KRML_HOST_CALLOC(16U, sizeof (uint32_t));
   Hacl_Hash_Blake2s_block_state_t
-  block_state = { .fst = kk.key_length, .snd = kk.digest_length, .thd = { .fst = wv, .snd = b } };
+  block_state =
+    {
+      .fst = kk.key_length,
+      .snd = kk.digest_length,
+      .thd = kk.last_node,
+      .f3 = { .fst = wv, .snd = b }
+    };
   uint8_t kk10 = kk.key_length;
   uint32_t ite;
   if (kk10 != 0U)
@@ -775,7 +794,8 @@ static Hacl_Hash_Blake2s_state_t
   Hacl_Hash_Blake2b_blake2_params *p1 = key.fst;
   uint8_t kk1 = p1->key_length;
   uint8_t nn = p1->digest_length;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
+  bool last_node = block_state.thd;
+  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint32_t kk2 = (uint32_t)i.key_length;
   uint8_t *k_1 = key.snd;
   if (!(kk2 == 0U))
@@ -785,38 +805,55 @@ static Hacl_Hash_Blake2s_state_t
     memcpy(buf, k_1, kk2 * sizeof (uint8_t));
   }
   Hacl_Hash_Blake2b_blake2_params pv = p1[0U];
-  init_with_params(block_state.thd.snd, pv);
+  init_with_params(block_state.f3.snd, pv);
   return p;
 }
 
 /**
- State allocation function when there are parameters and a key. The
-length of the key k MUST match the value of the field key_length in the
-parameters. Furthermore, there is a static (not dynamically checked) requirement
-that key_length does not exceed max_key (32 for S, 64 for B).)
+ General-purpose allocation function that gives control over all
+Blake2 parameters, including the key. Further resettings of the state SHALL be
+done with `reset_with_params_and_key`, and SHALL feature the exact same values
+for the `key_length` and `digest_length` fields as passed here. In other words,
+once you commit to a digest and key length, the only way to change these
+parameters is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The length of the key k MUST match the value of the field key_length in the
+  parameters.
+- The key_length must not exceed 32 for S, 64 for B.
+- The digest_length must not exceed 32 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2s_state_t
-*Hacl_Hash_Blake2s_malloc_with_params_and_key(Hacl_Hash_Blake2b_blake2_params *p, uint8_t *k)
+*Hacl_Hash_Blake2s_malloc_with_params_and_key(
+  Hacl_Hash_Blake2b_blake2_params *p,
+  bool last_node,
+  uint8_t *k
+)
 {
   Hacl_Hash_Blake2b_blake2_params pv = p[0U];
   Hacl_Hash_Blake2b_index
-  i1 = { .key_length = pv.key_length, .digest_length = pv.digest_length };
-  return
-    malloc_raw(i1,
-      ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = p, .snd = k }));
+  i1 = { .key_length = pv.key_length, .digest_length = pv.digest_length, .last_node = last_node };
+  return malloc_raw(i1, ((Hacl_Hash_Blake2b_params_and_key){ .fst = p, .snd = k }));
 }
 
 /**
- State allocation function when there is just a custom key. All
-other parameters are set to their respective default values, meaning the output
-length is the maximum allowed output (32 for S, 64 for B).
+ Specialized allocation function that picks default values for all
+parameters, except for the key_length. Further resettings of the state SHALL be
+done with `reset_with_key`, and SHALL feature the exact same key length `kk` as
+passed here. In other words, once you commit to a key length, the only way to
+change this parameter is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The key_length must not exceed 32 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_malloc_with_key(uint8_t *k, uint8_t kk)
 {
   uint8_t nn = 32U;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk, .digest_length = nn };
-  uint8_t *salt = (uint8_t *)KRML_HOST_CALLOC(8U, sizeof (uint8_t));
-  uint8_t *personal = (uint8_t *)KRML_HOST_CALLOC(8U, sizeof (uint8_t));
+  Hacl_Hash_Blake2b_index i = { .key_length = kk, .digest_length = nn, .last_node = false };
+  uint8_t salt[8U] = { 0U };
+  uint8_t personal[8U] = { 0U };
   Hacl_Hash_Blake2b_blake2_params
   p =
     {
@@ -824,20 +861,15 @@ Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_malloc_with_key(uint8_t *k, uint8_t
       .leaf_length = 0U, .node_offset = 0ULL, .node_depth = 0U, .inner_length = 0U, .salt = salt,
       .personal = personal
     };
-  Hacl_Hash_Blake2b_blake2_params
-  *p0 =
-    (Hacl_Hash_Blake2b_blake2_params *)KRML_HOST_MALLOC(sizeof (Hacl_Hash_Blake2b_blake2_params));
-  p0[0U] = p;
-  Hacl_Hash_Blake2s_state_t *s = Hacl_Hash_Blake2s_malloc_with_params_and_key(p0, k);
-  Hacl_Hash_Blake2b_blake2_params p1 = p0[0U];
-  KRML_HOST_FREE(p1.salt);
-  KRML_HOST_FREE(p1.personal);
-  KRML_HOST_FREE(p0);
+  Hacl_Hash_Blake2b_blake2_params p0 = p;
+  Hacl_Hash_Blake2s_state_t *s = Hacl_Hash_Blake2s_malloc_with_params_and_key(&p0, false, k);
   return s;
 }
 
 /**
-  State allocation function when there is no key
+ Specialized allocation function that picks default values for all
+parameters, and has no key. Effectively, this is what you want if you intend to
+use Blake2 as a hash function. Further resettings of the state SHALL be done with `reset`.
 */
 Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_malloc(void)
 {
@@ -847,28 +879,30 @@ Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_malloc(void)
 static Hacl_Hash_Blake2b_index index_of_state(Hacl_Hash_Blake2s_state_t *s)
 {
   Hacl_Hash_Blake2s_block_state_t block_state = (*s).block_state;
+  bool last_node = block_state.thd;
   uint8_t nn = block_state.snd;
   uint8_t kk1 = block_state.fst;
-  return ((Hacl_Hash_Blake2b_index){ .key_length = kk1, .digest_length = nn });
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk1, .digest_length = nn, .last_node = last_node });
 }
 
-static void
-reset_raw(
-  Hacl_Hash_Blake2s_state_t *state,
-  K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_ key
-)
+static void reset_raw(Hacl_Hash_Blake2s_state_t *state, Hacl_Hash_Blake2b_params_and_key key)
 {
   Hacl_Hash_Blake2s_state_t scrut = *state;
   uint8_t *buf = scrut.buf;
   Hacl_Hash_Blake2s_block_state_t block_state = scrut.block_state;
+  bool last_node0 = block_state.thd;
   uint8_t nn0 = block_state.snd;
   uint8_t kk10 = block_state.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk10, .digest_length = nn0 };
+  Hacl_Hash_Blake2b_index
+  i = { .key_length = kk10, .digest_length = nn0, .last_node = last_node0 };
   KRML_MAYBE_UNUSED_VAR(i);
   Hacl_Hash_Blake2b_blake2_params *p = key.fst;
   uint8_t kk1 = p->key_length;
   uint8_t nn = p->digest_length;
-  Hacl_Hash_Blake2b_index i1 = { .key_length = kk1, .digest_length = nn };
+  bool last_node = block_state.thd;
+  Hacl_Hash_Blake2b_index
+  i1 = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint32_t kk2 = (uint32_t)i1.key_length;
   uint8_t *k_1 = key.snd;
   if (!(kk2 == 0U))
@@ -878,7 +912,7 @@ reset_raw(
     memcpy(buf, k_1, kk2 * sizeof (uint8_t));
   }
   Hacl_Hash_Blake2b_blake2_params pv = p[0U];
-  init_with_params(block_state.thd.snd, pv);
+  init_with_params(block_state.f3.snd, pv);
   uint8_t kk11 = i.key_length;
   uint32_t ite;
   if (kk11 != 0U)
@@ -895,9 +929,11 @@ reset_raw(
 }
 
 /**
- Re-initialization function. The reinitialization API is tricky --
-you MUST reuse the same original parameters for digest (output) length and key
-length.
+ General-purpose re-initialization function with parameters and
+key. You cannot change digest_length, key_length, or last_node, meaning those values in
+the parameters object must be the same as originally decided via one of the
+malloc functions. All other values of the parameter can be changed. The behavior
+is unspecified if you violate this precondition.
 */
 void
 Hacl_Hash_Blake2s_reset_with_key_and_params(
@@ -907,14 +943,15 @@ Hacl_Hash_Blake2s_reset_with_key_and_params(
 )
 {
   index_of_state(s);
-  reset_raw(s, ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = p, .snd = k }));
+  reset_raw(s, ((Hacl_Hash_Blake2b_params_and_key){ .fst = p, .snd = k }));
 }
 
 /**
- Re-initialization function when there is a key. Note that the key
-size is not allowed to change, which is why this function does not take a key
-length -- the key has to be same key size that was originally passed to
-`malloc_with_key`
+ Specialized-purpose re-initialization function with no parameters,
+and a key. The key length must be the same as originally decided via your choice
+of malloc function. All other parameters are reset to their default values. The
+original call to malloc MUST have set digest_length to the default value. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2s_reset_with_key(Hacl_Hash_Blake2s_state_t *s, uint8_t *k)
 {
@@ -929,11 +966,16 @@ void Hacl_Hash_Blake2s_reset_with_key(Hacl_Hash_Blake2s_state_t *s, uint8_t *k)
       .personal = personal
     };
   Hacl_Hash_Blake2b_blake2_params p0 = p;
-  reset_raw(s, ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = &p0, .snd = k }));
+  reset_raw(s, ((Hacl_Hash_Blake2b_params_and_key){ .fst = &p0, .snd = k }));
 }
 
 /**
-  Re-initialization function when there is no key
+ Specialized-purpose re-initialization function with no parameters
+and no key. This is what you want if you intend to use Blake2 as a hash
+function. The key length and digest length must have been set to their
+respective default values via your choice of malloc function (always true if you
+used `malloc`). All other parameters are reset to their default values. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2s_reset(Hacl_Hash_Blake2s_state_t *s)
 {
@@ -941,7 +983,7 @@ void Hacl_Hash_Blake2s_reset(Hacl_Hash_Blake2s_state_t *s)
 }
 
 /**
-  Update function when there is no key; 0 = success, 1 = max length exceeded
+  Update function; 0 = success, 1 = max length exceeded
 */
 Hacl_Streaming_Types_error_code
 Hacl_Hash_Blake2s_update(Hacl_Hash_Blake2s_state_t *state, uint8_t *chunk, uint32_t chunk_len)
@@ -1007,7 +1049,7 @@ Hacl_Hash_Blake2s_update(Hacl_Hash_Blake2s_state_t *state, uint8_t *chunk, uint3
     if (!(sz1 == 0U))
     {
       uint64_t prevlen = total_len1 - (uint64_t)sz1;
-      K____uint32_t___uint32_t_ acc = block_state1.thd;
+      K____uint32_t___uint32_t_ acc = block_state1.f3;
       uint32_t *wv = acc.fst;
       uint32_t *hash = acc.snd;
       uint32_t nb = 1U;
@@ -1027,7 +1069,7 @@ Hacl_Hash_Blake2s_update(Hacl_Hash_Blake2s_state_t *state, uint8_t *chunk, uint3
     uint32_t data2_len = chunk_len - data1_len;
     uint8_t *data1 = chunk;
     uint8_t *data2 = chunk + data1_len;
-    K____uint32_t___uint32_t_ acc = block_state1.thd;
+    K____uint32_t___uint32_t_ acc = block_state1.f3;
     uint32_t *wv = acc.fst;
     uint32_t *hash = acc.snd;
     uint32_t nb = data1_len / 64U;
@@ -1090,7 +1132,7 @@ Hacl_Hash_Blake2s_update(Hacl_Hash_Blake2s_state_t *state, uint8_t *chunk, uint3
     if (!(sz1 == 0U))
     {
       uint64_t prevlen = total_len1 - (uint64_t)sz1;
-      K____uint32_t___uint32_t_ acc = block_state1.thd;
+      K____uint32_t___uint32_t_ acc = block_state1.f3;
       uint32_t *wv = acc.fst;
       uint32_t *hash = acc.snd;
       uint32_t nb = 1U;
@@ -1111,7 +1153,7 @@ Hacl_Hash_Blake2s_update(Hacl_Hash_Blake2s_state_t *state, uint8_t *chunk, uint3
     uint32_t data2_len = chunk_len - diff - data1_len;
     uint8_t *data1 = chunk2;
     uint8_t *data2 = chunk2 + data1_len;
-    K____uint32_t___uint32_t_ acc = block_state1.thd;
+    K____uint32_t___uint32_t_ acc = block_state1.f3;
     uint32_t *wv = acc.fst;
     uint32_t *hash = acc.snd;
     uint32_t nb = data1_len / 64U;
@@ -1132,15 +1174,25 @@ Hacl_Hash_Blake2s_update(Hacl_Hash_Blake2s_state_t *state, uint8_t *chunk, uint3
 }
 
 /**
-  Finish function when there is no key
+ Digest function. This function expects the `output` array to hold
+at least `digest_length` bytes, where `digest_length` was determined by your
+choice of `malloc` function. Concretely, if you used `malloc` or
+`malloc_with_key`, then the expected length is 32 for S, or 64 for B (default
+digest length). If you used `malloc_with_params_and_key`, then the expected
+length is whatever you chose for the `digest_length` field of your parameters.
+For convenience, this function returns `digest_length`. When in doubt, callers
+can pass an array of size HACL_BLAKE2S_32_OUT_BYTES, then use the return value
+to see how many bytes were actually written.
 */
-void Hacl_Hash_Blake2s_digest(Hacl_Hash_Blake2s_state_t *state, uint8_t *output)
+uint8_t Hacl_Hash_Blake2s_digest(Hacl_Hash_Blake2s_state_t *s, uint8_t *dst)
 {
-  Hacl_Hash_Blake2s_block_state_t block_state0 = (*state).block_state;
-  uint8_t nn = block_state0.snd;
-  uint8_t kk1 = block_state0.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
-  Hacl_Hash_Blake2s_state_t scrut = *state;
+  Hacl_Hash_Blake2s_block_state_t block_state0 = (*s).block_state;
+  bool last_node0 = block_state0.thd;
+  uint8_t nn0 = block_state0.snd;
+  uint8_t kk0 = block_state0.fst;
+  Hacl_Hash_Blake2b_index
+  i1 = { .key_length = kk0, .digest_length = nn0, .last_node = last_node0 };
+  Hacl_Hash_Blake2s_state_t scrut = *s;
   Hacl_Hash_Blake2s_block_state_t block_state = scrut.block_state;
   uint8_t *buf_ = scrut.buf;
   uint64_t total_len = scrut.total_len;
@@ -1158,9 +1210,14 @@ void Hacl_Hash_Blake2s_digest(Hacl_Hash_Blake2s_state_t *state, uint8_t *output)
   uint32_t b[16U] = { 0U };
   Hacl_Hash_Blake2s_block_state_t
   tmp_block_state =
-    { .fst = i.key_length, .snd = i.digest_length, .thd = { .fst = wv0, .snd = b } };
-  uint32_t *src_b = block_state.thd.snd;
-  uint32_t *dst_b = tmp_block_state.thd.snd;
+    {
+      .fst = i1.key_length,
+      .snd = i1.digest_length,
+      .thd = i1.last_node,
+      .f3 = { .fst = wv0, .snd = b }
+    };
+  uint32_t *src_b = block_state.f3.snd;
+  uint32_t *dst_b = tmp_block_state.f3.snd;
   memcpy(dst_b, src_b, 16U * sizeof (uint32_t));
   uint64_t prev_len = total_len - (uint64_t)r;
   uint32_t ite;
@@ -1174,18 +1231,35 @@ void Hacl_Hash_Blake2s_digest(Hacl_Hash_Blake2s_state_t *state, uint8_t *output)
   }
   uint8_t *buf_last = buf_1 + r - ite;
   uint8_t *buf_multi = buf_1;
-  K____uint32_t___uint32_t_ acc0 = tmp_block_state.thd;
+  K____uint32_t___uint32_t_ acc0 = tmp_block_state.f3;
   uint32_t *wv1 = acc0.fst;
   uint32_t *hash0 = acc0.snd;
   uint32_t nb = 0U;
   Hacl_Hash_Blake2s_update_multi(0U, wv1, hash0, prev_len, buf_multi, nb);
   uint64_t prev_len_last = total_len - (uint64_t)r;
-  K____uint32_t___uint32_t_ acc = tmp_block_state.thd;
+  K____uint32_t___uint32_t_ acc = tmp_block_state.f3;
+  bool last_node1 = tmp_block_state.thd;
   uint32_t *wv = acc.fst;
   uint32_t *hash = acc.snd;
-  Hacl_Hash_Blake2s_update_last(r, wv, hash, prev_len_last, r, buf_last);
-  uint8_t nn0 = tmp_block_state.snd;
-  Hacl_Hash_Blake2s_finish((uint32_t)nn0, output, tmp_block_state.thd.snd);
+  Hacl_Hash_Blake2s_update_last(r, wv, hash, last_node1, prev_len_last, r, buf_last);
+  uint8_t nn1 = tmp_block_state.snd;
+  Hacl_Hash_Blake2s_finish((uint32_t)nn1, dst, tmp_block_state.f3.snd);
+  Hacl_Hash_Blake2s_block_state_t block_state1 = (*s).block_state;
+  bool last_node = block_state1.thd;
+  uint8_t nn = block_state1.snd;
+  uint8_t kk = block_state1.fst;
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk, .digest_length = nn, .last_node = last_node }).digest_length;
+}
+
+Hacl_Hash_Blake2b_index Hacl_Hash_Blake2s_info(Hacl_Hash_Blake2s_state_t *s)
+{
+  Hacl_Hash_Blake2s_block_state_t block_state = (*s).block_state;
+  bool last_node = block_state.thd;
+  uint8_t nn = block_state.snd;
+  uint8_t kk = block_state.fst;
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk, .digest_length = nn, .last_node = last_node });
 }
 
 /**
@@ -1196,8 +1270,8 @@ void Hacl_Hash_Blake2s_free(Hacl_Hash_Blake2s_state_t *state)
   Hacl_Hash_Blake2s_state_t scrut = *state;
   uint8_t *buf = scrut.buf;
   Hacl_Hash_Blake2s_block_state_t block_state = scrut.block_state;
-  uint32_t *b = block_state.thd.snd;
-  uint32_t *wv = block_state.thd.fst;
+  uint32_t *b = block_state.f3.snd;
+  uint32_t *wv = block_state.f3.fst;
   KRML_HOST_FREE(wv);
   KRML_HOST_FREE(b);
   KRML_HOST_FREE(buf);
@@ -1205,7 +1279,7 @@ void Hacl_Hash_Blake2s_free(Hacl_Hash_Blake2s_state_t *state)
 }
 
 /**
-  Copying. The key length (or absence thereof) must match between source and destination.
+  Copying. This preserves all parameters.
 */
 Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_copy(Hacl_Hash_Blake2s_state_t *state)
 {
@@ -1213,17 +1287,24 @@ Hacl_Hash_Blake2s_state_t *Hacl_Hash_Blake2s_copy(Hacl_Hash_Blake2s_state_t *sta
   Hacl_Hash_Blake2s_block_state_t block_state0 = scrut.block_state;
   uint8_t *buf0 = scrut.buf;
   uint64_t total_len0 = scrut.total_len;
+  bool last_node = block_state0.thd;
   uint8_t nn = block_state0.snd;
   uint8_t kk1 = block_state0.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
+  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC(64U, sizeof (uint8_t));
   memcpy(buf, buf0, 64U * sizeof (uint8_t));
   uint32_t *wv = (uint32_t *)KRML_HOST_CALLOC(16U, sizeof (uint32_t));
   uint32_t *b = (uint32_t *)KRML_HOST_CALLOC(16U, sizeof (uint32_t));
   Hacl_Hash_Blake2s_block_state_t
-  block_state = { .fst = i.key_length, .snd = i.digest_length, .thd = { .fst = wv, .snd = b } };
-  uint32_t *src_b = block_state0.thd.snd;
-  uint32_t *dst_b = block_state.thd.snd;
+  block_state =
+    {
+      .fst = i.key_length,
+      .snd = i.digest_length,
+      .thd = i.last_node,
+      .f3 = { .fst = wv, .snd = b }
+    };
+  uint32_t *src_b = block_state0.f3.snd;
+  uint32_t *dst_b = block_state.f3.snd;
   memcpy(dst_b, src_b, 16U * sizeof (uint32_t));
   Hacl_Hash_Blake2s_state_t
   s = { .block_state = block_state, .buf = buf, .total_len = total_len0 };
@@ -1262,8 +1343,14 @@ Hacl_Hash_Blake2s_hash_with_key(
   Lib_Memzero0_memzero(b, 16U, uint32_t, void *);
 }
 
+/**
+Write the BLAKE2s digest of message `input` using key `key` and
+parameters `params` into `output`. The `key` array must be of length
+`params.key_length`. The `output` array must be of length
+`params.digest_length`.
+*/
 void
-Hacl_Hash_Blake2s_hash_with_key_and_paramas(
+Hacl_Hash_Blake2s_hash_with_key_and_params(
   uint8_t *output,
   uint8_t *input,
   uint32_t input_len,
diff --git a/src/msvc/Hacl_Hash_Blake2s_Simd128.c b/src/msvc/Hacl_Hash_Blake2s_Simd128.c
index c02da8fa..a85b18a4 100644
--- a/src/msvc/Hacl_Hash_Blake2s_Simd128.c
+++ b/src/msvc/Hacl_Hash_Blake2s_Simd128.c
@@ -34,6 +34,7 @@ update_block(
   Lib_IntVector_Intrinsics_vec128 *wv,
   Lib_IntVector_Intrinsics_vec128 *hash,
   bool flag,
+  bool last_node,
   uint64_t totlen,
   uint8_t *d
 )
@@ -59,7 +60,15 @@ update_block(
   {
     wv_14 = 0U;
   }
-  uint32_t wv_15 = 0U;
+  uint32_t wv_15;
+  if (last_node)
+  {
+    wv_15 = 0xFFFFFFFFU;
+  }
+  else
+  {
+    wv_15 = 0U;
+  }
   mask =
     Lib_IntVector_Intrinsics_vec128_load32s((uint32_t)totlen,
       (uint32_t)(totlen >> 32U),
@@ -366,11 +375,11 @@ update_key(
   memcpy(b, k, kk * sizeof (uint8_t));
   if (ll == 0U)
   {
-    update_block(wv, hash, true, lb, b);
+    update_block(wv, hash, true, false, lb, b);
   }
   else
   {
-    update_block(wv, hash, false, lb, b);
+    update_block(wv, hash, false, false, lb, b);
   }
   Lib_Memzero0_memzero(b, 64U, uint8_t, void *);
 }
@@ -390,7 +399,7 @@ Hacl_Hash_Blake2s_Simd128_update_multi(
   {
     uint64_t totlen = prev + (uint64_t)((i + 1U) * 64U);
     uint8_t *b = blocks + i * 64U;
-    update_block(wv, hash, false, totlen, b);
+    update_block(wv, hash, false, false, totlen, b);
   }
 }
 
@@ -399,6 +408,7 @@ Hacl_Hash_Blake2s_Simd128_update_last(
   uint32_t len,
   Lib_IntVector_Intrinsics_vec128 *wv,
   Lib_IntVector_Intrinsics_vec128 *hash,
+  bool last_node,
   uint64_t prev,
   uint32_t rem,
   uint8_t *d
@@ -408,7 +418,7 @@ Hacl_Hash_Blake2s_Simd128_update_last(
   uint8_t *last = d + len - rem;
   memcpy(b, last, rem * sizeof (uint8_t));
   uint64_t totlen = prev + (uint64_t)len;
-  update_block(wv, hash, true, totlen, b);
+  update_block(wv, hash, true, last_node, totlen, b);
   Lib_Memzero0_memzero(b, 64U, uint8_t, void *);
 }
 
@@ -442,7 +452,7 @@ update_blocks(
     rem = rem0;
   }
   Hacl_Hash_Blake2s_Simd128_update_multi(len, wv, hash, prev, blocks, nb);
-  Hacl_Hash_Blake2s_Simd128_update_last(len, wv, hash, prev, rem, blocks);
+  Hacl_Hash_Blake2s_Simd128_update_last(len, wv, hash, false, prev, rem, blocks);
 }
 
 static inline void
@@ -583,10 +593,7 @@ Lib_IntVector_Intrinsics_vec128 *Hacl_Hash_Blake2s_Simd128_malloc_with_key(void)
 }
 
 static Hacl_Hash_Blake2s_Simd128_state_t
-*malloc_raw(
-  Hacl_Hash_Blake2b_index kk,
-  K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_ key
-)
+*malloc_raw(Hacl_Hash_Blake2b_index kk, Hacl_Hash_Blake2b_params_and_key key)
 {
   uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC(64U, sizeof (uint8_t));
   Lib_IntVector_Intrinsics_vec128
@@ -600,7 +607,13 @@ static Hacl_Hash_Blake2s_Simd128_state_t
       sizeof (Lib_IntVector_Intrinsics_vec128) * 4U);
   memset(b, 0U, 4U * sizeof (Lib_IntVector_Intrinsics_vec128));
   Hacl_Hash_Blake2s_Simd128_block_state_t
-  block_state = { .fst = kk.key_length, .snd = kk.digest_length, .thd = { .fst = wv, .snd = b } };
+  block_state =
+    {
+      .fst = kk.key_length,
+      .snd = kk.digest_length,
+      .thd = kk.last_node,
+      .f3 = { .fst = wv, .snd = b }
+    };
   uint8_t kk10 = kk.key_length;
   uint32_t ite;
   if (kk10 != 0U)
@@ -622,7 +635,8 @@ static Hacl_Hash_Blake2s_Simd128_state_t
   Hacl_Hash_Blake2b_blake2_params *p1 = key.fst;
   uint8_t kk1 = p1->key_length;
   uint8_t nn = p1->digest_length;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
+  bool last_node = block_state.thd;
+  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint32_t kk2 = (uint32_t)i.key_length;
   uint8_t *k_1 = key.snd;
   if (!(kk2 == 0U))
@@ -632,42 +646,56 @@ static Hacl_Hash_Blake2s_Simd128_state_t
     memcpy(buf, k_1, kk2 * sizeof (uint8_t));
   }
   Hacl_Hash_Blake2b_blake2_params pv = p1[0U];
-  init_with_params(block_state.thd.snd, pv);
+  init_with_params(block_state.f3.snd, pv);
   return p;
 }
 
 /**
- State allocation function when there are parameters and a key. The
-length of the key k MUST match the value of the field key_length in the
-parameters. Furthermore, there is a static (not dynamically checked) requirement
-that key_length does not exceed max_key (128 for S, 64 for B).)
+ General-purpose allocation function that gives control over all
+Blake2 parameters, including the key. Further resettings of the state SHALL be
+done with `reset_with_params_and_key`, and SHALL feature the exact same values
+for the `key_length` and `digest_length` fields as passed here. In other words,
+once you commit to a digest and key length, the only way to change these
+parameters is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The length of the key k MUST match the value of the field key_length in the
+  parameters.
+- The key_length must not exceed 128 for S, 64 for B.
+- The digest_length must not exceed 128 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2s_Simd128_state_t
 *Hacl_Hash_Blake2s_Simd128_malloc_with_params_and_key(
   Hacl_Hash_Blake2b_blake2_params *p,
+  bool last_node,
   uint8_t *k
 )
 {
   Hacl_Hash_Blake2b_blake2_params pv = p[0U];
   Hacl_Hash_Blake2b_index
-  i1 = { .key_length = pv.key_length, .digest_length = pv.digest_length };
-  return
-    malloc_raw(i1,
-      ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = p, .snd = k }));
+  i1 = { .key_length = pv.key_length, .digest_length = pv.digest_length, .last_node = last_node };
+  return malloc_raw(i1, ((Hacl_Hash_Blake2b_params_and_key){ .fst = p, .snd = k }));
 }
 
 /**
- State allocation function when there is just a custom key. All
-other parameters are set to their respective default values, meaning the output
-length is the maximum allowed output (128 for S, 64 for B).
+ Specialized allocation function that picks default values for all
+parameters, except for the key_length. Further resettings of the state SHALL be
+done with `reset_with_key`, and SHALL feature the exact same key length `kk` as
+passed here. In other words, once you commit to a key length, the only way to
+change this parameter is to allocate a new object.
+
+The caller must satisfy the following requirements.
+- The key_length must not exceed 128 for S, 64 for B.
+
 */
 Hacl_Hash_Blake2s_Simd128_state_t
 *Hacl_Hash_Blake2s_Simd128_malloc_with_key0(uint8_t *k, uint8_t kk)
 {
   uint8_t nn = 32U;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk, .digest_length = nn };
-  uint8_t *salt = (uint8_t *)KRML_HOST_CALLOC(8U, sizeof (uint8_t));
-  uint8_t *personal = (uint8_t *)KRML_HOST_CALLOC(8U, sizeof (uint8_t));
+  Hacl_Hash_Blake2b_index i = { .key_length = kk, .digest_length = nn, .last_node = false };
+  uint8_t salt[8U] = { 0U };
+  uint8_t personal[8U] = { 0U };
   Hacl_Hash_Blake2b_blake2_params
   p =
     {
@@ -675,21 +703,16 @@ Hacl_Hash_Blake2s_Simd128_state_t
       .leaf_length = 0U, .node_offset = 0ULL, .node_depth = 0U, .inner_length = 0U, .salt = salt,
       .personal = personal
     };
-  Hacl_Hash_Blake2b_blake2_params
-  *p0 =
-    (Hacl_Hash_Blake2b_blake2_params *)KRML_HOST_MALLOC(sizeof (Hacl_Hash_Blake2b_blake2_params));
-  p0[0U] = p;
+  Hacl_Hash_Blake2b_blake2_params p0 = p;
   Hacl_Hash_Blake2s_Simd128_state_t
-  *s = Hacl_Hash_Blake2s_Simd128_malloc_with_params_and_key(p0, k);
-  Hacl_Hash_Blake2b_blake2_params p1 = p0[0U];
-  KRML_HOST_FREE(p1.salt);
-  KRML_HOST_FREE(p1.personal);
-  KRML_HOST_FREE(p0);
+  *s = Hacl_Hash_Blake2s_Simd128_malloc_with_params_and_key(&p0, false, k);
   return s;
 }
 
 /**
-  State allocation function when there is no key
+ Specialized allocation function that picks default values for all
+parameters, and has no key. Effectively, this is what you want if you intend to
+use Blake2 as a hash function. Further resettings of the state SHALL be done with `reset`.
 */
 Hacl_Hash_Blake2s_Simd128_state_t *Hacl_Hash_Blake2s_Simd128_malloc(void)
 {
@@ -699,28 +722,31 @@ Hacl_Hash_Blake2s_Simd128_state_t *Hacl_Hash_Blake2s_Simd128_malloc(void)
 static Hacl_Hash_Blake2b_index index_of_state(Hacl_Hash_Blake2s_Simd128_state_t *s)
 {
   Hacl_Hash_Blake2s_Simd128_block_state_t block_state = (*s).block_state;
+  bool last_node = block_state.thd;
   uint8_t nn = block_state.snd;
   uint8_t kk1 = block_state.fst;
-  return ((Hacl_Hash_Blake2b_index){ .key_length = kk1, .digest_length = nn });
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk1, .digest_length = nn, .last_node = last_node });
 }
 
 static void
-reset_raw(
-  Hacl_Hash_Blake2s_Simd128_state_t *state,
-  K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_ key
-)
+reset_raw(Hacl_Hash_Blake2s_Simd128_state_t *state, Hacl_Hash_Blake2b_params_and_key key)
 {
   Hacl_Hash_Blake2s_Simd128_state_t scrut = *state;
   uint8_t *buf = scrut.buf;
   Hacl_Hash_Blake2s_Simd128_block_state_t block_state = scrut.block_state;
+  bool last_node0 = block_state.thd;
   uint8_t nn0 = block_state.snd;
   uint8_t kk10 = block_state.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk10, .digest_length = nn0 };
+  Hacl_Hash_Blake2b_index
+  i = { .key_length = kk10, .digest_length = nn0, .last_node = last_node0 };
   KRML_MAYBE_UNUSED_VAR(i);
   Hacl_Hash_Blake2b_blake2_params *p = key.fst;
   uint8_t kk1 = p->key_length;
   uint8_t nn = p->digest_length;
-  Hacl_Hash_Blake2b_index i1 = { .key_length = kk1, .digest_length = nn };
+  bool last_node = block_state.thd;
+  Hacl_Hash_Blake2b_index
+  i1 = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint32_t kk2 = (uint32_t)i1.key_length;
   uint8_t *k_1 = key.snd;
   if (!(kk2 == 0U))
@@ -730,7 +756,7 @@ reset_raw(
     memcpy(buf, k_1, kk2 * sizeof (uint8_t));
   }
   Hacl_Hash_Blake2b_blake2_params pv = p[0U];
-  init_with_params(block_state.thd.snd, pv);
+  init_with_params(block_state.f3.snd, pv);
   uint8_t kk11 = i.key_length;
   uint32_t ite;
   if (kk11 != 0U)
@@ -747,9 +773,11 @@ reset_raw(
 }
 
 /**
- Re-initialization function. The reinitialization API is tricky --
-you MUST reuse the same original parameters for digest (output) length and key
-length.
+ General-purpose re-initialization function with parameters and
+key. You cannot change digest_length, key_length, or last_node, meaning those values in
+the parameters object must be the same as originally decided via one of the
+malloc functions. All other values of the parameter can be changed. The behavior
+is unspecified if you violate this precondition.
 */
 void
 Hacl_Hash_Blake2s_Simd128_reset_with_key_and_params(
@@ -759,14 +787,15 @@ Hacl_Hash_Blake2s_Simd128_reset_with_key_and_params(
 )
 {
   index_of_state(s);
-  reset_raw(s, ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = p, .snd = k }));
+  reset_raw(s, ((Hacl_Hash_Blake2b_params_and_key){ .fst = p, .snd = k }));
 }
 
 /**
- Re-initialization function when there is a key. Note that the key
-size is not allowed to change, which is why this function does not take a key
-length -- the key has to be same key size that was originally passed to
-`malloc_with_key`
+ Specialized-purpose re-initialization function with no parameters,
+and a key. The key length must be the same as originally decided via your choice
+of malloc function. All other parameters are reset to their default values. The
+original call to malloc MUST have set digest_length to the default value. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2s_Simd128_reset_with_key(Hacl_Hash_Blake2s_Simd128_state_t *s, uint8_t *k)
 {
@@ -781,11 +810,16 @@ void Hacl_Hash_Blake2s_Simd128_reset_with_key(Hacl_Hash_Blake2s_Simd128_state_t
       .personal = personal
     };
   Hacl_Hash_Blake2b_blake2_params p0 = p;
-  reset_raw(s, ((K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_){ .fst = &p0, .snd = k }));
+  reset_raw(s, ((Hacl_Hash_Blake2b_params_and_key){ .fst = &p0, .snd = k }));
 }
 
 /**
-  Re-initialization function when there is no key
+ Specialized-purpose re-initialization function with no parameters
+and no key. This is what you want if you intend to use Blake2 as a hash
+function. The key length and digest length must have been set to their
+respective default values via your choice of malloc function (always true if you
+used `malloc`). All other parameters are reset to their default values. The
+behavior is unspecified if you violate this precondition.
 */
 void Hacl_Hash_Blake2s_Simd128_reset(Hacl_Hash_Blake2s_Simd128_state_t *s)
 {
@@ -793,7 +827,7 @@ void Hacl_Hash_Blake2s_Simd128_reset(Hacl_Hash_Blake2s_Simd128_state_t *s)
 }
 
 /**
-  Update function when there is no key; 0 = success, 1 = max length exceeded
+  Update function; 0 = success, 1 = max length exceeded
 */
 Hacl_Streaming_Types_error_code
 Hacl_Hash_Blake2s_Simd128_update(
@@ -863,8 +897,7 @@ Hacl_Hash_Blake2s_Simd128_update(
     if (!(sz1 == 0U))
     {
       uint64_t prevlen = total_len1 - (uint64_t)sz1;
-      K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_
-      acc = block_state1.thd;
+      K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_ acc = block_state1.f3;
       Lib_IntVector_Intrinsics_vec128 *wv = acc.fst;
       Lib_IntVector_Intrinsics_vec128 *hash = acc.snd;
       uint32_t nb = 1U;
@@ -884,7 +917,7 @@ Hacl_Hash_Blake2s_Simd128_update(
     uint32_t data2_len = chunk_len - data1_len;
     uint8_t *data1 = chunk;
     uint8_t *data2 = chunk + data1_len;
-    K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_ acc = block_state1.thd;
+    K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_ acc = block_state1.f3;
     Lib_IntVector_Intrinsics_vec128 *wv = acc.fst;
     Lib_IntVector_Intrinsics_vec128 *hash = acc.snd;
     uint32_t nb = data1_len / 64U;
@@ -947,8 +980,7 @@ Hacl_Hash_Blake2s_Simd128_update(
     if (!(sz1 == 0U))
     {
       uint64_t prevlen = total_len1 - (uint64_t)sz1;
-      K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_
-      acc = block_state1.thd;
+      K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_ acc = block_state1.f3;
       Lib_IntVector_Intrinsics_vec128 *wv = acc.fst;
       Lib_IntVector_Intrinsics_vec128 *hash = acc.snd;
       uint32_t nb = 1U;
@@ -969,7 +1001,7 @@ Hacl_Hash_Blake2s_Simd128_update(
     uint32_t data2_len = chunk_len - diff - data1_len;
     uint8_t *data1 = chunk2;
     uint8_t *data2 = chunk2 + data1_len;
-    K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_ acc = block_state1.thd;
+    K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_ acc = block_state1.f3;
     Lib_IntVector_Intrinsics_vec128 *wv = acc.fst;
     Lib_IntVector_Intrinsics_vec128 *hash = acc.snd;
     uint32_t nb = data1_len / 64U;
@@ -990,16 +1022,25 @@ Hacl_Hash_Blake2s_Simd128_update(
 }
 
 /**
-  Finish function when there is no key
+ Digest function. This function expects the `output` array to hold
+at least `digest_length` bytes, where `digest_length` was determined by your
+choice of `malloc` function. Concretely, if you used `malloc` or
+`malloc_with_key`, then the expected length is 128 for S, or 64 for B (default
+digest length). If you used `malloc_with_params_and_key`, then the expected
+length is whatever you chose for the `digest_length` field of your parameters.
+For convenience, this function returns `digest_length`. When in doubt, callers
+can pass an array of size HACL_BLAKE2S_128_OUT_BYTES, then use the return value
+to see how many bytes were actually written.
 */
-void
-Hacl_Hash_Blake2s_Simd128_digest(Hacl_Hash_Blake2s_Simd128_state_t *state, uint8_t *output)
+uint8_t Hacl_Hash_Blake2s_Simd128_digest(Hacl_Hash_Blake2s_Simd128_state_t *s, uint8_t *dst)
 {
-  Hacl_Hash_Blake2s_Simd128_block_state_t block_state0 = (*state).block_state;
-  uint8_t nn = block_state0.snd;
-  uint8_t kk1 = block_state0.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
-  Hacl_Hash_Blake2s_Simd128_state_t scrut = *state;
+  Hacl_Hash_Blake2s_Simd128_block_state_t block_state0 = (*s).block_state;
+  bool last_node0 = block_state0.thd;
+  uint8_t nn0 = block_state0.snd;
+  uint8_t kk0 = block_state0.fst;
+  Hacl_Hash_Blake2b_index
+  i1 = { .key_length = kk0, .digest_length = nn0, .last_node = last_node0 };
+  Hacl_Hash_Blake2s_Simd128_state_t scrut = *s;
   Hacl_Hash_Blake2s_Simd128_block_state_t block_state = scrut.block_state;
   uint8_t *buf_ = scrut.buf;
   uint64_t total_len = scrut.total_len;
@@ -1017,9 +1058,14 @@ Hacl_Hash_Blake2s_Simd128_digest(Hacl_Hash_Blake2s_Simd128_state_t *state, uint8
   KRML_PRE_ALIGN(16) Lib_IntVector_Intrinsics_vec128 b[4U] KRML_POST_ALIGN(16) = { 0U };
   Hacl_Hash_Blake2s_Simd128_block_state_t
   tmp_block_state =
-    { .fst = i.key_length, .snd = i.digest_length, .thd = { .fst = wv0, .snd = b } };
-  Lib_IntVector_Intrinsics_vec128 *src_b = block_state.thd.snd;
-  Lib_IntVector_Intrinsics_vec128 *dst_b = tmp_block_state.thd.snd;
+    {
+      .fst = i1.key_length,
+      .snd = i1.digest_length,
+      .thd = i1.last_node,
+      .f3 = { .fst = wv0, .snd = b }
+    };
+  Lib_IntVector_Intrinsics_vec128 *src_b = block_state.f3.snd;
+  Lib_IntVector_Intrinsics_vec128 *dst_b = tmp_block_state.f3.snd;
   memcpy(dst_b, src_b, 4U * sizeof (Lib_IntVector_Intrinsics_vec128));
   uint64_t prev_len = total_len - (uint64_t)r;
   uint32_t ite;
@@ -1034,19 +1080,36 @@ Hacl_Hash_Blake2s_Simd128_digest(Hacl_Hash_Blake2s_Simd128_state_t *state, uint8
   uint8_t *buf_last = buf_1 + r - ite;
   uint8_t *buf_multi = buf_1;
   K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_
-  acc0 = tmp_block_state.thd;
+  acc0 = tmp_block_state.f3;
   Lib_IntVector_Intrinsics_vec128 *wv1 = acc0.fst;
   Lib_IntVector_Intrinsics_vec128 *hash0 = acc0.snd;
   uint32_t nb = 0U;
   Hacl_Hash_Blake2s_Simd128_update_multi(0U, wv1, hash0, prev_len, buf_multi, nb);
   uint64_t prev_len_last = total_len - (uint64_t)r;
   K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_
-  acc = tmp_block_state.thd;
+  acc = tmp_block_state.f3;
+  bool last_node1 = tmp_block_state.thd;
   Lib_IntVector_Intrinsics_vec128 *wv = acc.fst;
   Lib_IntVector_Intrinsics_vec128 *hash = acc.snd;
-  Hacl_Hash_Blake2s_Simd128_update_last(r, wv, hash, prev_len_last, r, buf_last);
-  uint8_t nn0 = tmp_block_state.snd;
-  Hacl_Hash_Blake2s_Simd128_finish((uint32_t)nn0, output, tmp_block_state.thd.snd);
+  Hacl_Hash_Blake2s_Simd128_update_last(r, wv, hash, last_node1, prev_len_last, r, buf_last);
+  uint8_t nn1 = tmp_block_state.snd;
+  Hacl_Hash_Blake2s_Simd128_finish((uint32_t)nn1, dst, tmp_block_state.f3.snd);
+  Hacl_Hash_Blake2s_Simd128_block_state_t block_state1 = (*s).block_state;
+  bool last_node = block_state1.thd;
+  uint8_t nn = block_state1.snd;
+  uint8_t kk = block_state1.fst;
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk, .digest_length = nn, .last_node = last_node }).digest_length;
+}
+
+Hacl_Hash_Blake2b_index Hacl_Hash_Blake2s_Simd128_info(Hacl_Hash_Blake2s_Simd128_state_t *s)
+{
+  Hacl_Hash_Blake2s_Simd128_block_state_t block_state = (*s).block_state;
+  bool last_node = block_state.thd;
+  uint8_t nn = block_state.snd;
+  uint8_t kk = block_state.fst;
+  return
+    ((Hacl_Hash_Blake2b_index){ .key_length = kk, .digest_length = nn, .last_node = last_node });
 }
 
 /**
@@ -1057,8 +1120,8 @@ void Hacl_Hash_Blake2s_Simd128_free(Hacl_Hash_Blake2s_Simd128_state_t *state)
   Hacl_Hash_Blake2s_Simd128_state_t scrut = *state;
   uint8_t *buf = scrut.buf;
   Hacl_Hash_Blake2s_Simd128_block_state_t block_state = scrut.block_state;
-  Lib_IntVector_Intrinsics_vec128 *b = block_state.thd.snd;
-  Lib_IntVector_Intrinsics_vec128 *wv = block_state.thd.fst;
+  Lib_IntVector_Intrinsics_vec128 *b = block_state.f3.snd;
+  Lib_IntVector_Intrinsics_vec128 *wv = block_state.f3.fst;
   KRML_ALIGNED_FREE(wv);
   KRML_ALIGNED_FREE(b);
   KRML_HOST_FREE(buf);
@@ -1066,7 +1129,7 @@ void Hacl_Hash_Blake2s_Simd128_free(Hacl_Hash_Blake2s_Simd128_state_t *state)
 }
 
 /**
-  Copying. The key length (or absence thereof) must match between source and destination.
+  Copying. This preserves all parameters.
 */
 Hacl_Hash_Blake2s_Simd128_state_t
 *Hacl_Hash_Blake2s_Simd128_copy(Hacl_Hash_Blake2s_Simd128_state_t *state)
@@ -1075,9 +1138,10 @@ Hacl_Hash_Blake2s_Simd128_state_t
   Hacl_Hash_Blake2s_Simd128_block_state_t block_state0 = scrut.block_state;
   uint8_t *buf0 = scrut.buf;
   uint64_t total_len0 = scrut.total_len;
+  bool last_node = block_state0.thd;
   uint8_t nn = block_state0.snd;
   uint8_t kk1 = block_state0.fst;
-  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn };
+  Hacl_Hash_Blake2b_index i = { .key_length = kk1, .digest_length = nn, .last_node = last_node };
   uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC(64U, sizeof (uint8_t));
   memcpy(buf, buf0, 64U * sizeof (uint8_t));
   Lib_IntVector_Intrinsics_vec128
@@ -1091,9 +1155,15 @@ Hacl_Hash_Blake2s_Simd128_state_t
       sizeof (Lib_IntVector_Intrinsics_vec128) * 4U);
   memset(b, 0U, 4U * sizeof (Lib_IntVector_Intrinsics_vec128));
   Hacl_Hash_Blake2s_Simd128_block_state_t
-  block_state = { .fst = i.key_length, .snd = i.digest_length, .thd = { .fst = wv, .snd = b } };
-  Lib_IntVector_Intrinsics_vec128 *src_b = block_state0.thd.snd;
-  Lib_IntVector_Intrinsics_vec128 *dst_b = block_state.thd.snd;
+  block_state =
+    {
+      .fst = i.key_length,
+      .snd = i.digest_length,
+      .thd = i.last_node,
+      .f3 = { .fst = wv, .snd = b }
+    };
+  Lib_IntVector_Intrinsics_vec128 *src_b = block_state0.f3.snd;
+  Lib_IntVector_Intrinsics_vec128 *dst_b = block_state.f3.snd;
   memcpy(dst_b, src_b, 4U * sizeof (Lib_IntVector_Intrinsics_vec128));
   Hacl_Hash_Blake2s_Simd128_state_t
   s = { .block_state = block_state, .buf = buf, .total_len = total_len0 };
@@ -1135,8 +1205,14 @@ Hacl_Hash_Blake2s_Simd128_hash_with_key(
   Lib_Memzero0_memzero(b, 4U, Lib_IntVector_Intrinsics_vec128, void *);
 }
 
+/**
+Write the BLAKE2s digest of message `input` using key `key` and
+parameters `params` into `output`. The `key` array must be of length
+`params.key_length`. The `output` array must be of length
+`params.digest_length`.
+*/
 void
-Hacl_Hash_Blake2s_Simd128_hash_with_key_and_paramas(
+Hacl_Hash_Blake2s_Simd128_hash_with_key_and_params(
   uint8_t *output,
   uint8_t *input,
   uint32_t input_len,
diff --git a/src/msvc/Hacl_Hash_SHA3.c b/src/msvc/Hacl_Hash_SHA3.c
index 89bb0491..9cf5abb3 100644
--- a/src/msvc/Hacl_Hash_SHA3.c
+++ b/src/msvc/Hacl_Hash_SHA3.c
@@ -2166,7 +2166,7 @@ void Hacl_Hash_SHA3_state_free(uint64_t *s)
 Absorb number of input blocks and write the output state
 
   This function is intended to receive a hash state and input buffer.
-  It prcoesses an input of multiple of 168-bytes (SHAKE128 block size),
+  It processes an input of multiple of 168-bytes (SHAKE128 block size),
   any additional bytes of final partial block are ignored.
 
   The argument `state` (IN/OUT) points to hash state, i.e., uint64_t[25]
@@ -2191,14 +2191,14 @@ Hacl_Hash_SHA3_shake128_absorb_nblocks(uint64_t *state, uint8_t *input, uint32_t
 Absorb a final partial block of input and write the output state
 
   This function is intended to receive a hash state and input buffer.
-  It prcoesses a sequence of bytes at end of input buffer that is less 
+  It processes a sequence of bytes at end of input buffer that is less
   than 168-bytes (SHAKE128 block size),
   any bytes of full blocks at start of input buffer are ignored.
 
   The argument `state` (IN/OUT) points to hash state, i.e., uint64_t[25]
   The argument `input` (IN) points to `inputByteLen` bytes of valid memory,
   i.e., uint8_t[inputByteLen]
-  
+
   Note: Full size of input buffer must be passed to `inputByteLen` including
   the number of full-block bytes at start of input buffer that are ignored
 */
diff --git a/src/msvc/Hacl_Hash_SHA3_Simd256.c b/src/msvc/Hacl_Hash_SHA3_Simd256.c
index 131c34e6..e0bb7e0b 100644
--- a/src/msvc/Hacl_Hash_SHA3_Simd256.c
+++ b/src/msvc/Hacl_Hash_SHA3_Simd256.c
@@ -5992,12 +5992,12 @@ void Hacl_Hash_SHA3_Simd256_state_free(Lib_IntVector_Intrinsics_vec256 *s)
 Absorb number of blocks of 4 input buffers and write the output states
 
   This function is intended to receive a quadruple hash state and 4 input buffers.
-  It prcoesses an inputs of multiple of 168-bytes (SHAKE128 block size),
+  It processes an inputs of multiple of 168-bytes (SHAKE128 block size),
   any additional bytes of final partial block for each buffer are ignored.
 
   The argument `state` (IN/OUT) points to quadruple hash state,
   i.e., Lib_IntVector_Intrinsics_vec256[25]
-  The arguments `input0/input1/input2/input3` (IN) point to `inputByteLen` bytes 
+  The arguments `input0/input1/input2/input3` (IN) point to `inputByteLen` bytes
   of valid memory for each buffer, i.e., uint8_t[inputByteLen]
 */
 void
@@ -6038,15 +6038,15 @@ Hacl_Hash_SHA3_Simd256_shake128_absorb_nblocks(
 Absorb a final partial blocks of 4 input buffers and write the output states
 
   This function is intended to receive a quadruple hash state and 4 input buffers.
-  It prcoesses a sequence of bytes at end of each input buffer that is less 
+  It processes a sequence of bytes at end of each input buffer that is less
   than 168-bytes (SHAKE128 block size),
   any bytes of full blocks at start of input buffers are ignored.
 
   The argument `state` (IN/OUT) points to quadruple hash state,
   i.e., Lib_IntVector_Intrinsics_vec256[25]
-  The arguments `input0/input1/input2/input3` (IN) point to `inputByteLen` bytes 
+  The arguments `input0/input1/input2/input3` (IN) point to `inputByteLen` bytes
   of valid memory for each buffer, i.e., uint8_t[inputByteLen]
-  
+
   Note: Full size of input buffers must be passed to `inputByteLen` including
   the number of full-block bytes at start of each input buffer that are ignored
 */
@@ -6378,7 +6378,7 @@ Squeeze a quadruple hash state to 4 output buffers
 
   The argument `state` (IN) points to quadruple hash state,
   i.e., Lib_IntVector_Intrinsics_vec256[25]
-  The arguments `output0/output1/output2/output3` (OUT) point to `outputByteLen` bytes 
+  The arguments `output0/output1/output2/output3` (OUT) point to `outputByteLen` bytes
   of valid memory for each buffer, i.e., uint8_t[inputByteLen]
 */
 void
diff --git a/src/wasm/EverCrypt_Hash.wasm b/src/wasm/EverCrypt_Hash.wasm
index 1447feb38afaaca8ed624e0dc44b1238d670b653..70c58ff8fbe9165f06e52dc9e9869015bdcc23ce 100644
GIT binary patch
delta 84
zcmaEIl=;<BW-f-r;#@`s1_s8h6S+PKvDX7ZU41=ceFB(SUq4xpQE8$->%=&j&HjvC
ie2o7#-{LRjW4y9CK+c4N$&q1mi<&kgh+eO5x*GuJb{vWT

delta 59
zcmV-B0L1_5#RKHU0}23Pb8P_t0005AkqYvWuoRI+8Iv#p1+y>#s}2GBv)m7L4gt`!
RQXVu2vxp`u0kgFyHM??26z%{3

diff --git a/src/wasm/Hacl_Bignum.wasm b/src/wasm/Hacl_Bignum.wasm
index 6e090b50b5acc4b01d3eaa14e9a14507c7cc0467..9858cc28d9d2b50006974993d3546bb2ac6e8ea0 100644
GIT binary patch
delta 2595
zcmeHI`%~0a6yNjRFR%jyh_DEX0?~{FDn7#3P`e{G)=ZQ$<qQUaI*BQ;P&3ua`XKuO
zNOITfwCWI#DW_%v48PGX34%OA19Tx9Qj&+}_(B0SwV8s>xxn|kU{n49{_?r!p8GlH
zeD3|8d%s6o#3L=Dd5&7WYnMekyHeK)Y!F<<#fwzHVud;4!Wfmn9txqL#%ZAYhO~E5
zGm>MLs6;kP2mu$CB1C{I%NJ&Y8*39HL9<_smR?qyH6Tje9#sMk7Oy=t_)i<4LGZgt
z!)>j*h{K;j_xLPWRO9S!$RQdE!gFZwp6l<1!!rx)E;#fo;aN5=O{X=-3KPY>66;B`
z^*R#`U8|aiS@_aDN^OZx6+pxKNBlu#-fPp*wPWpz$YV9t;Vf_SYH8jZKdC`u)dc`i
zyb_3FN~m(hi6wrkRG8v9HNm`1OUDyPd7IlsB{+Q>1$S@j9}5m=ebwG<=-p@0IrBZ-
z+k_5-M7)cVL15F34BdU-&%ko^#!YDN+d+1gDUlu89w)Cw+Y{Jp+4=H(GPgwbN86Pg
z<#q%6CfiSn+?frSvZgu-s|Ni5G?{grA%1)Ob;O~Zrx7D+o<mILxceirTe%IjHngj2
ziRpEMn86>@>Xs9PMI7t6$Gz?%dal*Ik7bhUBdAQ?Nh%ZEK*3456r7VwVQmeBx46Bm
zk?f2{Dl;vgnAuIlEN&uyeLkT_Goha22hCJQx0lMa{m9Go7f_k}Qxx2LDjad}(-nv>
zoF?4Pv1A|FL#LY&OU;RhBW7YQYbF0%7QzZ{U+3t({|<Tr+IM4_gYBznH$7*H5qF-&
zb7a4rrC@NZM2zKV<XG|<d4?UWh_xNWoY_fCT_^cX9PJ!?50WSP=X;1ghpCL^uz|`z
zA(bgDq~Os)3SQnt)RfN&E4h7(W5lmirmu*Y&leN(!}G)`E+!n}cGLy3w_KnyN!?VY
zr~5W2O?&1GBl^~S+2x8&w6KqwFTI?asH2>0b8jN^Eu%&pTgxoFEZdWLS?tY<1@c;E
zSpxgJ!d=c2dh{G-v&8@Jr4ZB@^KTa-i(R!*{;@TuMwiO%UUY6x8XOPdNrOMy;BT`v
zJ(Y52PVQQIIwv}NYR4K_On(%vkNrL93GVFA#LKek(sG!g360XL=BiX75qe0|i)nna
z)kkCpE+0is-0$=<Nf}r4c-O`=7>5nAJvvNxjQ6r+x+4H<y;dVH7F}0};Wx5nV)YGA
z2+{=cQhJ{dRoax&y*E=Pa!Bh2yyzxz?NavO)yI*cCCTjWC55~94@HUZeMQMv_y1c-
z`vXNu+`|q<Nz`B8DgV<4BcEW)?irnrcx<$1LN0UiTQ>p>DX&##*?McE00t0ki`5W|
zLakXMXhF2*if|0QD_tNGcVSC)g;!~H?7wbpcf%NYrkf6Q`uw}w92z+3#QfUbnK|DB
zOfs{{13Zb@;R*OOTJdAxCdVt-HarFXxXp=afe&bLqmNf#0BfBe_@V4`esIM}j6>@z
zW?g`jn1O&vVtfOg#pDITc_%T(U}$g>;}ZsE)L$9~c<@$77*ttXLSd1j_7TD_{{Xpm
BQD*=E

delta 2622
zcmeHI`%~0a6yNjRg=K&Mk%wRu5Y0%S;v;-TvLiOuOq4U_3<d!@i7Bv9Gu65)Ncsbi
z<gV9g)gc~JOw9xsexqFy1bKvp$U+t=$wPB|ArB?3nS#!_!1udgQ~m+|^10`p`#I-)
z?){#7zh$kevR0Mx$pFZP>?Ft%vJtr{figS0>bal6IXU(1l=Q^N<qBZ?gg_8jvf#&t
z!BMqrsY1!hgiuhi4&e!KkQSCiDjeC65C&?tRtN&8gQ^JeC8f~`K<sg;7H}}R?WMtc
z&L9nf*DV@`e4JG{{OLc&X8|fD&h7>tp`joohX(fr-fA44UTk&1p?5jYvSmdYt=U!^
zDDLGbSDI~(Hqg+$u9=vHFOE@aQ*4TWq6Wsj0hs&7G<5CW_yY1+ZA}Qv+qPa@`1%h@
zP@AKDfhcZqL@~rwJL1F?yF)BYa-E%E;no#X3B<f@?J7AqZ6^iy>>QX34q^Q@?rh|p
zXV5wSUEJHW4y{PMOQKd_b9D^e{ol^Rat*qzXdl>3cBUbo9oZEltwmVl*sJ<{X+D!%
zBKae%a*hhCmVKr762r3efGKNh60oZOcW489`~*Y%`owF9BRNkYhSoldn8<O@hh(>L
z8|o}**VGZy?IbY+_R;G0lY~Va>$%6d{t|kw*T08l5*tFPOx`If6VOP(3Aq%UlS^S|
z8wqc7du0>Z=}lB-PCha9&BQEjCVxXdp-T&)hU5D!R3>^ql{x!8FEda;W%5r`aNp?=
z#Nm%uBd$F|xQk=S0kTKVv>=um;}OS=#9Y}%{x?m8mE69;(f!~Z^!T>#!7_*2*VAr#
z&lMwPb>KO&UppumY-<psIO;f-d_ta4TN`3sCo$)D5i`1r{05Fzj(vy86Y=91qQ_Ax
zV>+s(GEhimN((7?qL6}DbrUt|Q^G24-{u(l3zg|FBIfhO#Qfj_af*uxN4On+k?idk
zsZ2r-mFevn0=a3=eWpX-hR?elv5A)SQ}d-&P!n}lkZtUXXP)KMh?8p><yRzoCNGn{
zQMp)J%P5aye^)w7d4i6e$84t9|GgA~5@Y`DLS(XQ7Ro=lX4mLqh1HGD?NNi{Av|jE
z2OIn?wxPF5>dcv4OHb!?XV30fEsGoo$Mwm-2R*@E0~vT()?Ho&^VC7%8pQ&IA}~|~
zsTx%(pX~4ecIe76<iz|&FO!&lRfBhJDuZrRE7=pHbjNrvi-tP_zP8tErNyEfGBM<)
zULw}qbOnF4KQE>62vnrbD&2Q0X*!3vY0!;s64x&3hp#=13?Gur?p~I;`+t{}c;1th
zd~xr;m9*cNmBjqfDJu#8>l^uhdVl;QY}vgNix7`b^iIoVc7F2~fD!q%$|&D#ZV~|B
zNy{=NMA18zsRGn(&Q-y2^saG$Fx-VD#Svbi)ye<5xm}Gh(kyx|(CPE<Zm~JRDLdwu
z&i2ejE?|(D%`V_d%uZLpr_qcb12;KU!IJzKc;hywrv)D1gByLg`U05iy}%1)pZ9{R
zc4BNk_F^{q+KCzTogv24&t6QPA6&2#qYHpWJ24)?U_||;!GH&Ewgp4Axituu%4#1V
G{PYh&N>+RT

diff --git a/src/wasm/Hacl_Bignum32.wasm b/src/wasm/Hacl_Bignum32.wasm
index c2102b8189b2a5ab8d663a53be33e8f1e9a552e4..cfbbf5e97f243a758c4f16e6e02022a1f45f1ed6 100644
GIT binary patch
delta 681
zcmaEs{w#fhloE4&eLZ7+0wb8HW2%QS5rPvBicQvM<lGot%sBZYqbMWOWGyBIM&`-h
zOqz@=lcz9gGqO&e&nVAgXvV+>WJpd{VB(Zx=MGOS&J8XtD9A4=5kO+cmlP!yY~IK8
zo0XA$^Dd6%OpNT4cX4EGKEvI?B*iM_$e_W%;K-uDkmJah<H(W&=4T18PtN0;j89sc
zzYpjP13^)saR>O5VM-Mk6d1D5OtKaD1Xr5J7d`obL>|y70zwLmK)r^-%i)smg}Z?w
z)gpR8=~W`mAZY{f^^@m{O#%uSh}$v3RU#Y1!^ok)ps1msApmnvrBp6Z>vO41Ky9<6
z)j;MPltEZiFM9|m;Uve&%)=_BzyNWr0Q2N<#b9A%0Yz>FZbt^Q$%6ValW!_c1)7qt
zbQ(xnD+3)kIZJsfkW^5y0LDzD%4|lC&0kd(F^WS&RDlyM5Z0;P16tav{+vmSRT1c5
zN5*VNmOMvBXkY=YKd;j(!Kx?<jsOK=kai#f#SSnwHtTD5F_NQkvc7iy=Eu6sprCU!
k07lm4zk0xcg>okU)vK9&*<cM&xWUi@7*3ma8tF0u01mdIk^lez

delta 671
zcmaEs{w#fh6fa{vV|@a1eLaX`oG2?f@u<*beMZiW(Z!6DS2GH$8JaOLafc@s=LVM+
z6yz6`2qUrMb5nDxQj78#m?zI?l;ldx$xP3SH#1>inf!!Nfsu7GE0ZQ8+vJ5za*XVg
z^_jFc?`QhO%E+>L7sqlYMwZFDII=dM;qG9P;*fG=&|qM2WKm$qab(PKWXS>ZvjkWs
z=kZO(CoRq2$H+0+Ku{ED+yVY%m{J7>1%@m%lWYY(!IkFmMNfVpkq2~&fRF+sP_Loz
za=7Gs;clQvwTK>2dX<PXNZLSr{p7h~lYjyS;&zO1mB_~MFmfm`C~7EZ2*BJ^DU}P<
z`dn%gP}?kNHIO+6Wf0cX%N_zsILUD`^KeKhFhE=@z&bfxF<2N`K#^O4+mXR+vY@`q
z<eQ39fu`guod%ND%0LHB&QjhABo$OF7+EJrs?26&-~3f&5u-RXL=`yE0%4unJ)ot%
z>d%?PI23^nc4W+UWXW@6ga#JS`tv%y5*&)6;0RC<25AQ(Q0xF>W3#??7b7_uC+lnH
sZ+@)H3<^3&17Kur{;LNJSSV-mU%i^imkrhcg&PblfZ?=xr;#or0J_YeQ~&?~

diff --git a/src/wasm/Hacl_Bignum_Base.wasm b/src/wasm/Hacl_Bignum_Base.wasm
index e407cd7801c73d69dfcdfc15c6db86c600fcf01f..9e75139e78655daed16185b0b7c989c0559e0df4 100644
GIT binary patch
delta 1271
zcmZXSTS(J!6vy{-n=Z_pbDKJK?xuOS2rqb_mr|!wx7pNOVrJl)X<kC{!F<V(Qs<u_
z3iKhNmylwWy@Z#_H1VN_A_eKC=%q|zfkaWi?|FzI2A`ds|M&1=|8x9H%)i8@;>6;S
z5wBY7Egtm#JiwSx%M2_)m|=P*_Rbm%l3-_BUzdHLr>DEOU-3`f+STUqbhnG7LLf_G
zfx;1{WkEtOOYtqT3C1Kot2kTAB!X4k>H8{sCgB}l2;&cgM~4K?%1{UAOsJ7_B{Y+B
zpO`L3eU^AjzQAi+7?O9xklYBvQ>Fm3iCx4yiXGk=4Zp-S`{7B@7*x<aR$(|;jo}P6
z#yW_%iLZ%45zs6~AgPQ*GA9zr3&c6%Hc=i0&2AJl9U9V1MnhwaY2X}+F>%hs<Z^Bi
zm9eO6iQ}<rytZpwIPYtbe51uvc^qgVULh{WedC>ny31UXsV~RB88*yvMjKt6Lq^gV
z^LV{YRGU!Sh!ds_UN^@h`6M36op?NrN&p*(UgBngpLbRcLsOdA4UI1e8hbK^A0%V=
zZ8F9bDWH`&PFziaW;zwgy;LMsX~@(QuM^ja(sXEkq(d{Dag%F&%A>sj{A=u(J3u4T
zm_>;qk&b`dX67+VJoMWw=WEOQ%v1YWJ!1aVnM>DmJ`eBvcOI7I$j7n<^RcXX;s>Ip
z0G+x5tW{Qsq^l6g(L(eWh+l}tB6OOHb~v+(vDW!wTI)MAG@cR+FPC8WV+o?srC>dA
zjQF$^nt?JTUzH)bTZW9O9Bd{|5m(EhnL7?m^a;|GS3t8>f#LK@yhVE@u3>_>PLx!k
zQ&jbWQ)<EWoUtG|W<h_2_=}iRjZR-RuIF40-uI^(x}LOJtaY;%%Sx%ka9tgib&a@2
zl+>eBT#vOLv?1xXAvtM7e}fogM_o!BvHN-5?||mJgRZCJBs5YdhTEMOzUsulb8xy5
zWj=AR5tgzhmt0~N>81KWom3Z?B@*fPgo_pxfAq2mVR189L>wkAG(&pt6qgEVEvx?>
ZkL>U9_(EJ(Ty)E6tVh|3i5so&{{Y>NQ7-@h

delta 1294
zcmZXSSxA&&6o%)U#WBnr_uOY3HFuG4A(wGnN*&jkF_$#6GH}u~mr#r*Z!)CR@h^x1
zy-4ULq?pQX!lg1zyy&7xLApu0DU+B$f~fPJ3khQ2`Okm8_x)eyJI6IIT=QZ)B23tY
z{gk*Ow-dSCgTiiiWM7uFVxJIFywD1{V=7W8B$J5KDm`jjdO9q9U0t2sy_$dO=HBj>
zE}6<P6`@Q`m$^x|M1oK|wsg)pF)D;`Rwy!5^tlQ}oAbN-OC@!jp41o8(*qK*#LG&Y
z^wJX-z0!!g%w!Gfv&_4iS*p$6P(JX6a@8BB!UxP?b};YzY*J^)_Y%eI`o<w9(jPI;
z{9*P8fH@@qwpQjn<~yc35HWLsQ2HH&GV>sm7nsw`4W=dtG220iX$|I>u@J=QLu-fw
zp;5%i&?Cfkre7H9O6Ew|GS!ywM&hGzDBp+UR1*Q3nAeyK5kIK&M0=HD(sV`mH-nK=
z#1MTGaX`;8`Yft9m;q6!&CJoLRjM1Jp?n?<<z_TagJQrMrh~Z_<D$;uA;c8Kb|S_Z
zhZsvd%#Y(?{tyqFPXbuM9APdcAZ8*F%AG_g{ga@nX5M73FjdKj`IU^A!IV1`<Md1I
zmeXVSuuUGU4mQeSWil=OY(~*;RJQZGO+#Z#|4ORe^ezQG+US<(JLj`--+!_&ENeD~
z)t`-F%`iVRgLBZS%E4IObD?a?g>ont{aNNWrrv-~y<wA>k%zI)<ndTP8WGc;5A#Ak
z%v<@8h7^F+%wgt>0>tzcLix53%I!jEqKd!<<~Vby2r<(~5fgHZV~UCqvtA5yatUtH
zQi5$5Wv(!lrRW$+UlUa(Y|m*El*1<U7n#4AnPuqolwo_$mE*p@l=Jo^Rbs4bl^9k+
z70gvt7}gEuGE-TNPF^*}y59_?%?#z38U0nJ+Jd@(X}7qj?zJN3r<J#-^*CZwwJ@Kl
zh533d46ne6I+WSW{yL--);DQ{QKnPr+_WmKTe?i9+mSAs{ORaTJ;aIz(7+sI&Nd+Q
i;Ry<rk{Xx(TORkl<#Bp8RbXElPhvcN&2Zdq{`42|lT~~G

diff --git a/src/wasm/Hacl_GenericField64.wasm b/src/wasm/Hacl_GenericField64.wasm
index a475b2db329ea3d4bdae0fec0cd095ed0aa465d5..8f12cc14ad73bbe5770910a34afb72b399327c38 100644
GIT binary patch
delta 387
zcmX>WeJpx{loWG)eLZ7+0wb8HW2%QS>lrtih%!#jVH9O#n!J=zfsuLgF-A>BmdX4~
z+KjA|Z5fpq*?^?v<k^gzjO>#?Fv@MVV(McSXO(hf&|qLtU~pv2apcGWbFu{3C*Nm1
z$;iHWC7U}V533YRR)Bf(ANF8WfoP5$K=VX6uK>xHoO(b~f(s;ak;?+;1}^T|j2xSn
zaho$UvQCmwWMrSje;nu>0eK0a=@0q!7=e_4pac_K%t=^<5y<gV04kW=Ad&!NKNJxK
zs`@U%$pYtyOTGYV!D65k<78R6PjJ&T<&jKFS3sC{Pr()FBB;?;DppMJfZ#+8h|S$<
Mu^>mjRKLp#04<SOBLDyZ

delta 376
zcmX>WeJpx{6fa{vV|@a1eLaX`oG2@~(Seh3vKpf>i=i0<(_~vlMMmbyKN*!6StiFb
zDloE6ZeY}8WScC*B*(};c@?AfW-F#XW^oQFM+OZB1_cI3#vDhE955$KfMxQ1){~4Z
zn^&^AGxBgq!DIzkC;wp&Miq$W*a5Ubg!2lJe95T?Bqg{&A{V(VfOc|m&t_!byo}qN
znUQ0Xj3Oh;B>v-!9Fqm)C4i<s<kw>aQUZb!OmHzLVHHLo$4>#MU~+><0+9VsL=>p%
zy9g%>oFgvz0;mOxfl`c<W#vA>P1BS|GA&&JVcI<fSD=faMq8;^F~I|Z6Ez?<cdNyM
K9QjiHE-L^fOH};;

diff --git a/src/wasm/Hacl_HKDF_Blake2s_128.wasm b/src/wasm/Hacl_HKDF_Blake2s_128.wasm
index 03362c9f65beb7722af8eb9cbff0a8f177f1f292..d3975181e198953ec1263118652b776e2c8f0329 100644
GIT binary patch
delta 103
zcmeys^?_@GloWG)eLZ7+0wb8HW2%QS>lr7S^iO;y%E&ZXo>763d9nkeCL_z_PDX7;
y)`^AkEQV$bY!eG5xe{|S)AQoZOc>ZFXEDlc-onVk$jCbRAd@sB`{uh$lbHbhnH&rN

delta 86
zcmeys^?_@G6fa{vV|@a1eLaX`oG2?f(V=-_tuTwB83WVA?TU=d6AL9L_b_rYvP`_G
pz{ooBmnI|I<Y|m@jO>$D7_~QVVdP<C<d}SrNt%&m^IfLNOaNOy7-awe

diff --git a/src/wasm/Hacl_HMAC.wasm b/src/wasm/Hacl_HMAC.wasm
index 8752dda84afaa84c96f21a1f3e5cde1bdfba0ba5..e20a106ced044d30bb833780ca044b59b152de15 100644
GIT binary patch
delta 108
zcmZp;!`OF+k&7X*IG2%ufq`+xM6NY#?DarUH*urz#B;n%?DZS(TxDZCwRsb}t~*oX
zjLi@Ijx#ekGHhNERL8`~uvs-!oCQc(M=oJxoVNKv6ekNv@@3otRuJ8pGL0QX%jY~~
F1OV}bB%1&L

delta 95
zcmV-l0HFVl+yQ{x0SW+Nb8P_t0004&kqWE<29dZV0S2+&)dm5+v$O{-M+y6vfPer3
z0)B3@{2KxRv+Pg40<)}Aegd;BRTc!ZL|LN&0g$ukS_uTR^Io6@vz26)2eU0~;Q>e(
BBc%WU

diff --git a/src/wasm/Hacl_Hash_Blake2b.wasm b/src/wasm/Hacl_Hash_Blake2b.wasm
index 29138d3dc1dc597d2e8982aa1a7293c07bf36257..57b34c6b6b7777a4b39813bdb1186cb1dd52831c 100644
GIT binary patch
literal 23807
zcmdUX2Y6h^b?%+Tf>>Zt7QGSVIRHrj6iKjxB&fm#i%5|YEmNdT+Y$tlAcaLC1%k2)
zNI+#JS(fA$+j8V4r#OiXCr)wV#7UHw^5VpCsuSlWah}uT6en?cQC=M9KQnXZ&hB1-
zjKB9i$M`<nJ7;F@IcH{0yL0AlFnVc91wo+x{LzJlp!;5RRb9m;F+YE=npewQ%I4<_
z+gG5%)Y&HB0D|(cHfpcXRZF#+#|m(0PL`@K=xI7doJT}MJ`ztofq~Xm92uP%of?}g
zn;M%+1ex?}Fb~HsU%Yr>X12*IkDMNxy)Zd8xIGB`E}d~*MlOz?nHW18D8FX`veC)$
z^V1_hmhihY_{gS4CnqnQ3CjEq1vm^t+qMQtze~o)F*`GQF(~(&V=!zP3|9DEx_k_0
z?i)KZF>?CyxpQMPBbUY>9t$e`zKwogOyI*~GZ%tX$Dz?PlOu<xE>4aNPmWHEZ5`Qn
zVfxbS==AKRZryZf^wNE{>Ga6R$oa8Z;66V!de`Xb$+4hvndf<_=f@w=504B7RpE+O
zogJMW9Rb~$*|Pbd{NQnvn)G$##Np}LEn9buT;8@7tAN(B7ZxB4t?BBT+PX}ALt|5O
zOKV$uN9W3}RjY|te2=uQm=CfGDvj&QL3GVXQD4wj@v%HQwzQOTIX*o;8&t0<ZMb|9
zY>tggU7nmB59+#>>@YccX*S4o9m?)II&vs`{Lsko(d>}}TZeH!w(rQu@Tt2F94||B
zmbM=|ahGi^i)lS_;FN7mt}K1_c=l-ca5<GWzv{rNj~}}ud(>iBv7wZEBgP|d9G|@p
zY5`5VG%`AUc4T7gp`a;dG5zk+r@3t@ltIf4rA;$qmmo`;7@pRY4AG#CuGKqeZ(X8G
z&=JFhS+}4wrs?eX`7tck%2+WtcOmGCX*f4CHWsXkX*hG?;zPme)upW6CrT6!HK6s^
z=;2QWR~prTK9^NgedVK%LiGRU<B;4FiK~_KWmn7Q6IW~I)z$v_>Z{ebC-9%dztqd!
zFE8DeysGBSf9n4s4xuOi*`O~7xGJ0BG^H~Y9U9JNvT8D$n$$oplgI{~;z~+U<sdp&
zQ}uALGYBZ1RTG>p+lxYQB)M1jrfNW`$sASp2VSQF4ArV!rPEZ+HK?w|^R?N`;qdty
zuA_3)fI4_klR3^%2DrGM>bZd$xRL5~bB-E?iQ25nacvC#Y?7O($qgyF+>n~7*$k;k
zhSUU>n!F)31Ck*%+aZ}wF(j#(TPTsdIy_%K9HhCG%3QgPS}2)?iPK{;h+qJF)Zyej
z?%CjAa-NdqX8Kh&vGnw}Q+pvMJihpJK~<_pp>ksJ$vK&!!tN>EeP@sY{~grMoz$7W
z9<nQGWg!jV=}{AlPYa2aGJArti&pX~T9xM281L%B@upDKx--b&*0vLtL@`mo4AJYx
zgm-%r&VbZ}o^x_VJNeSW=<G?Pm8T$EZPqx)J!oG8q-(NCCs;kamU>Wwl>{m<5f<~j
zj@BB8*2!qrh)Au8A%Uu1VC~ITJFLCgs*6}u?!z$pso#m)vKq9W)*Er_m%;P{WxqH2
z^?*d&*4q)APBHAzdcJ{f;0<&`)=GDdHv&k7)36DEo0Ea;m%s6euU*Mh@@Cphec2$F
zO-|-S`?t83t+W*_%C&5BE!$~3S`w~hhie(6L9~>)mYuF;7wtkz(zWb%EkiVfmU7p!
z$F<x@H=<>QYq`m_+)Ov4rNXt`;#&67UbLiKOV+gv(=b{pUCTb#vY+;&rOLG&a4iSv
zAX?I{<yO~nhz_Bp+O-^ZEw|BaXsK~6M_kKMI*OKB*K)gSxr6RNOPy;uMm4m<N+-Vx
z!0r&Z6TnR&@M_usaEk>+TsP3GpnSO9Day5hUM<R1Lp#GKjsw^e0(SwpB?L~;Mu6Kq
zTpQ`Q;Mz!c39gNF!r(d(K5-KL4~M{O0Nfq|ucb`@vmUNZbW(6_qSpwnP4rrW>(=mz
zQ|Nyr1YQT=SO~nH1_18!a1GEY!8Jgy6I=uIdck!Azrh#%yM58W#~1w(D9^oF#iQ8-
zpU#%?84BoLNPnm&X916T@EH1^gI1pN%*R<iPiIkM&BvH4&hdS8-avGptj9SqALnB9
z6;<QFI$nS^2dv{E);GA~98XZrKr|s(#|7(n3|8=d#^Zewus^mbJTeWc(;n4HzCe?x
zv16HX#XMi63kIT#LUmfGPRCK5<oi)Q1I#lX=KJ{)-H#fBnP+J>OK?tdeewyuOqWa>
zT^8gsf_x?pc|fPVAw5tu#5dxR2SNBjkMINh5IukzJES+d;v7Fr4;hFa7OD>l)d%CL
z`a<vssQO&Y;gKt#dc~vq2w$Z~P-CgixniE@>8gQfUZ`FXs#oHuKEewM^^YpxepGqL
z7Zg9HXhBJ>ozKS=J+88Cm{HvNWJ;e<gifXhJ)wjY0MNoU&PNu=MqXiz{+OSXhn^Bn
zp7J@#D}GuLdZX43^+^wy<2NZn2h&P#(p&%l7r2&kfvRVO#xq4U-mGb$*3!6JdYJMY
zKdT7srh=Z;BmjT}uB9X}E?+60lY#nL@w`0r7GdHoJ`>L=eybw%My+Myc@N0*+Z3UL
zX{EPmE&zZFTw}NZzPC%mJA~3Zd`fRu{9TIPuB6sb;&&=~r^;rqxVUYW#eJ6|bTU2Y
zU78vIP{TEbTA{qYTgL29!VB`ydxVqs_?*03@pmgiZ`9f`zu*CL{GuXsFs<~W<^lk?
zz%`bOQBQZ@D_r<$^gem${ldljeJ<Xs_yda28?}~;_jy2`Kd1;DOe=j*a{&Nc;2OgP
z@Vz7r9}-F*@+rNf_<Iz+q@>o){P!yQUX{HCGmo2+ng2dT=wy1(_i1VXKn>RzYC#l$
zeLn`AbrINy1#%(S4=DP6#XqR%2UUNN;vX`F41dHF+W4cU5b&ZD=!Z066h4ANN@_le
zLPiRUD74Xs6@N_8$AB%vKWqwZ{3E6i@W)Ld#Xl+q`eBU?g&)z_Q24mUhQg0(Y(Jp*
z#}xe-u(k1zn?k@pVG1e!geheBC#66?uCbx;6B-)|pU~J)_({QrY5FP57=IEkGyKyE
zUiW826i^rW-A_pkIz%-;E7SXPvSvT$ui2**|GXk}N3E5PpY?z_epwMZm{xjOvjza`
zg=^`0q3Rce#xE4n_#c`EYAua>q=zZb@h>VuyQ!dG)Fc3a1g@ndFtDHT2lh)Pga2iD
z>{o=1U-8-aCB^?!5xS$+vhm9vkmp}jgbt>aepT}U0DRyY!w2wvS{i;$DE*pG>C=jT
zUD2nN)EY|s8AYE_+GFb*6yY}%p_A!BzoDrC05x1=s0D<jj+XPYGU|eP_)U52w}hA9
z@_G5J;@?(;?x?k+{!I^<<KIz)4yKiUNAm#yeBc_(M}b)VuJBR7+3(3?pA$Yl=kxKq
ziho}bx}(<e@p~SS=RZ({4yKj<K=T0reBc_x2k?Df8valy{h?3k^NRnMqR%U-wX^?6
zivGxWcigmh|6@hyWO~paYia;M4c8cIMe6k@GU`wI>+uD7>`#T4KlOR}6UF~q5xS$+
zj`|B8Fvnk1gbt>azNq;C06uUn<pWiJCN%!6h{m658mP52Mx=)+&+%U<Lc6J;ztAKA
zfCR3kB#OoAFJ-6&w&kznvA-5J{@Q2bFBSidB6LTsW#g|rAkTlR2pvo-{jKH$0QkT)
zh7aKTk~I9CQ2INc(w7wfy`nEEsWp`N9~AwA@$k555C4yf(8=_mf7H|ffEunb)QW`o
z%QET$_4+4y?4N~~fA)F#vf_VHgzl)dqy8rknB%V~LI=}IU(tL303W!<@=+jGUll$I
z)az^V*w=-Rulsy_Rq_8(gzl)de0<FV^8Bxg(809QziK`JfDc?__yE3Fq~YI$(!cqX
zUQzsi6}_UQ*3SOFEBbfi<#E$q{u_$W$@HLaXlejJ4c8cIo|pd*j5zZ0-xSDs`Go}i
zhvG*Q^k_mn>0_o4@Z+YC;wMZY!+9ytV~L#sqV@zmjzUTbPoR*ILLP-S`ljM16Z9mo
zW%wymXyd0%A>cQeLW-Y}0zIX%q42cEhQgaPHWZ%G*cKA}<^;VN*i!tgDP;ILQ)uJo
zO##8N6zExv4Ta}4HWZ%M*id+j#?~v-)f+ck2&EH*B?(`$-<F_&-;PUE^$vkttn^(1
zxmkQ?0!ZJLz`DLG;k^{SHNo#r5HO?GN)T{5AkQx(2pvoXy`b3#048xQT~k!OM`*mK
zh{kto8mP52z?%c|{9=O8!Bo(Tng#&Sz%`b}dxge(eHw2|@cR;kIYF(Zf!T0Cp5LD!
zbTAe4eoX@aXy6)4;{!tD14T4GsA-_q(s*Y=x)>nOFC_>aOa;B9X#fBXT;pg^RY7(7
zBhM@>1kH)7jYuRQN4(^JxlV>O+GIlown|f!D%>i?UcY1_OtPVzS0D$lVlW7hb*Rh+
zLqR|glL<~?h}dR!$p+*kAYM7D+!%PBz+{BMZVp$*=Qx%kiyVg`yJU_-$W~jjrc)eQ
zo#Vi`vQUJgE&Yf^u0<B(Wjz2SGKK;rNsXZ(VQyu(1%pA7YV{_&Ktr$&`c_Z1R5chh
z;Z`#UOHs>p*_0$q+~ivAil1DhRLnj!cB>~igUQW!lUol6l0x<UCX-`2#f?%DGXWAa
zo@zJwn%(Rxc8lEstwMgJ6{xw*RUow?R;j~PAUPpMZ>6i~qAszit6aruTHPNIldE9j
z{-6&T0<+s)#XZ#1A8f{ceps=V*7gUxu<73{d58eF4zat<v{I~YGp!Pv+d?F5Ez~V-
zNES$2i{uB|VAQ^;?&n@g=sR}O?G}E*Wd#}{8@Hb7kOm>yYs6-Iliu4GlPH-j?B2@+
zY@iLikv8%s3b+0@32p5A=NO5B5@ANw0M=?C>l0idNU>bJxqx6Bx<#q9Ewn`lVw<10
z(Kg<WM1VBsXuA*`5P}0S1gU}g7O8hJn_7I*!@e;{EMmW+u&Qhk`%`{ZUyxjs?Y}(!
zgi3>l0jn+3>sM_IGK*f1jX}L8i$^omAkx}K4Kjuua!c``+%mjVZf(3vZp6Fg*2hC~
z+su39wu^71HrkQro2Y{Z^L#VXSv&K53$3DEdEQGzyYrl-ZW_w-Fs-3IdEQ6s=*B$n
zr$)L-7;mJTh1o{BMR;kXy~0ZqWu>i&hNZ2E_DNe4?MGWSpo)UYOn>1iV=vRo*h;aZ
zh4yj<RJwvHmQm>>ms66;#a_a&8kMdPm9Bu8fCpzUQ-EZ-Q<y<v+jIhx5e927CEts@
zu&>f-U!|*km9BBR1xqH2Q|Bsl@;1fwt^z4sS+GV|fh4UgU9+obp%z)hR#(wRZL*y0
zuA+lFWMMm91(K7p#9hcf*U7l5sa}?&T2jOr+?r*nY9#v@;MOi}HPk6>HPj_-i1)0H
zZVVJMm_8gZ5}8bxO7b+WGE#B&x{HdFr*YlXEfWGG#A|2`Qjn~hbF@}?A<;OBnSWHR
z1Hp9#1f7ca77%Phw@AhNs80wY7s*I7!o>9I<{aH11lI|{buk2~l2$L$Dx>25=&g$T
zRaV8Ls$vzd^!T$X?pJ9QkDe}2@k*oOl`@76gj<R?$}I!yh+7*E$c=cj-1>Nn+&06Y
z;kJvn;b_2yJa4CZ+L(uhXrxVfScqmC$iqUk(&jwxLOOg)9u}gLw&r0Wx@cP-7NW{n
zz$)4yvQb5YA{$k-Q)DAeyJYIpv|HNJG$d_l+GA9FMZsjIKl2z=JdwDXp4Tpy5xp4q
zpD1$w6;Ra*N{P-^A+B0bi$bJIh7SffjT%N2;<SDNFDBwOJWuYSs3DxCkT41H^8{Bz
zbP&HdwXczCsC|u%S4<}`9$~O*UxQer3@0#Z5kw@o9(d|KJQ+a9%L}SHSF|{#1!^9H
z6UQFpa6<s0z@lU3YBT9_4F(~Y?m#?)5hgP@V^V-4{fbQJ3Ugpa4y=^fiIq?^4gS(p
z?%XcoupH1#E;2?RKkeQ*7R(t{%cR$sN!Me~dPg)Q#)=MX%)zQ%8!7A^mHCeqArX3o
zJyHcdQgfJEIpE?^&KFl)DQbTrFPqmm?2)1j&dDT6q(=*jL>UdF5UR*r*Hc3VQ!Ud3
z0Sh>q472>`QWW8T@JY;mGNF$zRoj`r9??X&4U2-%G~jPhG$Rb2Xs&?Rl#2k03_?un
zAf~k#aXB|Y6dF8H#ZW_0MciPER#XLKbmn3jORaCz4?!-%T&=2&Mrs;y$_Nr3$%z~t
zil8|-wk4#-!`gBkeGn~M%B_ZSD<bD>qn6`BhT(SeSUckDYd?m_+dkH59_vIDe(lE)
zpWDZ}%wt`M)vx^+qImn*YV+7?CPdqX^NP`W^D2r|*ds+4nCk&W!l^C-)2=GWqXO(i
z6;}w(Hv;pXBDFBwI`l?S8GJTOmS>_wccRrxzaqz4Ve>0On~&INK~3xEX+d3-lXWnG
zqFP7phas$j_?1&t8s^=v$0OyGPD5W{DJcQ6Ntpk-4g*3p%V4jPnM|>P{B=2K?okJs
zYnndc$a<W#nQ-AI0S1ksHsmw49kK)mjr~q)MyjbiQ(tZZuj@KDrqy37jAv#Iu3EvB
zE;czYK5fRc&d%lva2m$Hp%cuMNuX;y-jac?xT%y?`DFv$Y(`wLcv^dE3+ORJGBIKh
zVJxa(U1a&fLyE$*#L;PlDN!d#MM)fuc?Eh*LLqv@$p(FmpsxXX_-}_EZ}S?x#L|M^
zbc#bSFZ@d^cf^Wp2tXvU)u!#Hosz;TCEE^#RSDUGK=eE)ZiVUwgKF(v3J}SO%xrM0
zya?kQBP2K*q`5I<sd&r7V+lr*n=$NW@8~D$aL5uH4o)WlS#F!fXTg+~&Tx~QN|kr6
zMo1Z6$halkY{4?N;)ynpY0Hv}5>S_;wj9Ce+L#}ZCDSHkBzGCHYTZvOw<CZF=MWl(
z)01Lv%$vQuHFOrh0k8B1f>&kk3a16`3o9YZX12Q`T5@)hIwg)<MJr`RR#BI%!YZ7n
zT<wU1SEd4Hl8g$csg)>O7uk(9A)3JZM>lpr0$z)`=<y_N4ImrQtrfBYF*=lvpRr+5
ziA@jUKH$Knhm+P`Ko-Y3SG4mfEi5}E(HO%}BQzqIM!c;=Ypyqhu~m}9Y04U$P^F>>
z`{UN$rL29ZpnzctjLj>aT5ppLJBea4q6L%j7FOxKH@vCHl*7JX2U3^`!seVrwF%jy
z6Ej)`v)x$y>i^j%j8$uJR_$ek%1cp*W=rgxFoX?Ist}355QII1Zjss2gV(kT<Bydq
z?Scf$lIBdTW!kQq=@heSGQP;1U7M_IZ0gsNCC!|Wt+iyY%gilfQ^d^S?ZKHjJ#B?m
zdWA7l+O)~7Otw5_<ub+(0+QWTeZvN*SidIRVEx*}`h^R&3>OkuHbO-jvn!p+K^=~(
z8_Q-41|U1?Mlm@snI$Sh4RU}z8&HsGVu@vn6yZZQ><Hh8V0*JcrkQZ(GEPbW0m)21
zFCjeQ0}dq*`hx8wrwM(5Y{v_%2bBY>tasgQTqLFo!93c{*>y2>=>iy^1cdWatbd*$
z>(?z2!5T`7AlFcptb)9C71~vV^^Q3qhS~RE`4GToCLxi0yz+a*C2Y?K@kXi_;*HcG
z#3gu_aNRjZ%(Kr-l3U=R!Uza^#Gzen6}#Fz!EFS;fcfsgg2Qb%o7fJ>+QbeaD^R>&
zY2i*N^GbX=&;=au5e~;nKo&=*D_WtE7I7#gLX!<5yIKc#5=~WPS67K$l{d_2*xJ1m
zxp6oYGq1}CJA;L8@ZIgXan$9g8%Y^ZFd_rU^4%@M-W|g?Vr=Y%WN;(x#+iH2YYkAZ
z@mx0qJV$GCgtpLiuL)7F5!B-2qGb<VO|j;D&bp9rlLjsX2qW>=v85CD1k^zsM<o7L
z1u*s@!kH=-f6x73FGu8F_9h|s3b#s;KrcbG%)_vwq{PkC8aIQmj{>U8v=+OWPs)dL
zQ1+Hc*$YNy6h9nE!YY0UD~wbOK?q}OYN?S$lPsaK3`u+-hNN&y$;iHqt|B85uiH6W
z)-fUlW;_&n#izi;L)BaHHJxH)jF18gr)n8>5i<l^=@d_UsKP4kq2Lp=c`_af&Otm>
zxZz+t6e@>;df<a=LhMTo;-O&Au7e8+qg$X^EuM!$9U|hKwuaV2wS=05fI5e$x>U1Z
zv=B^R)A(Zlo?1nEvCl38X+tQD&ypa$*YaqhmznlrkM{L<K**b-Z|EwpEm&z&D*d?o
z@LH<~I!e@PYepwq$(58?9G<7jD<|>pQdSOwg?Hk|hJ!l^yU-`?3yrP)a2if9Ay&U?
z;&ypSHgENw(a>-6)+&ilg`2}lN7N)13i0FR&*3+<z+VTKSQk2&3@JFe4BoF2HkybW
zLjz(9>lh#awrC_2iv(d1QI?1zGC!dugnxqxS)7yQj5qGlGv3Qn^m$(R@+4Ah%tXw~
zQ-mXYd6M*W1{+u{dea>1-zvLM+zBb{EVl2RIqyY^IzuV!6e;YCAC*lIV^_uORmg{E
z@Q&W<;6=)<hOEwN4;EP<BDXr^t&XY1>M+5t9W>~Pc<~B%>%F9e&bs33BfMjYTQWWs
zbIbB>6~Refn^n9noOb<~21<@R^de=0taCuUIwZx2`>2=uMfTR<L$!YFm95Lv@p`if
z6S{l80qg390KtwV%+_NN8z?~=CeUk|k#NR+5^0qLZJOW#$lGR8v?&z8Ek&b4&e$7G
zz}pJoB$6(hG~ON8F+%xdjAVp^;RtuqAn(FALfdFNJ{sFhJ21fAv>FMTExd<@kh~q>
zn;<MVWg|7X5s+1bJ+A1~;AUOLcpy#<ZV9<8HrA2o@?Jce1<kA%+n_E-*_^kF2*^5z
ztO#f}h92#u)gu0TiA48|3JlX;-iOZnL1BNf3hd7j+QJZLe@J1!P}m<s0aXV=anL4;
z4`MxU#d;nL*Ygle)?qpftWlhEn}&^v5~Voe!J-uSc+E-FQBR;uE#&ETI)X325V*ie
z@*Q+5AEP_)?b<=U6QjD*TdP+AvTJqB72R6BT30b1h+C`U_=N5tOx9i3v1TWL;v{IF
z^wtb@IXao6+c0)(vQCCGdQxWeWDH$8K}TfGPRN&VvLW;uI>E2S{S>gDDqgQsIYL{w
zUZ+Crrv&?{80@He9oFOZ^!kGJc!P$c^|;%EWj*epd)#{5<E@9O#d?g;h%-|6&<Kpw
zz4Qi<h>X-IzW0fYQoyGR;3S`ckvbbr^fE?jjK=6*QQ@&rh0oC#p9gz%n$F;ZxVz~r
zbojndD)r%;G>^mD9Gvj%ltA7{qE?J1r#n;57_14B`y@}A+Q|u?qC-55Z!%q`>q60B
zFVe+=!QNj0CwT^siY>f!9RtRvY;=zdcs3mHWt!y&@Esk#ccTYrnl53yZ=}2VLArpC
z(H_KiXH)zLq~#G$4;}_&_23~_bb2tSs~8W&>A{td%Vlg9j@a=$XwG}`kGdSq=k(lI
z`JWFZbY3JBAyNrFe7$zJ$p2Nk$1IsOTUg(#{HVeck15c3OckrbV=70|9x4N1Yah`U
z#BeR8hN{PvO)8}EO`Gf@=k?cMcpdS0OMmfMgnlWLkE}zeCt+U)_!obR<RHjK*6siA
zyAIS@r#d_aWE(%62QjY*@Ek1aEZa<BM2PJt7ZI9TC_p_DoDJA-!)rs~+ssni$Josf
z>BKe%q^u-vl*mxB7C3L?b;1NkFLO3t!+sOU;vmlTkwt3Kkj0zAgnhM${4}CIO;!&3
z32&xT9NA?unh}c#9@`6EqVOIhKXOp?UZskvbT*@%nkAco-5JSdAQP&$L5xzk{Sj=)
zM2W<xb|rP1pEtnFtcK{X_SAY6AgHxWZkH?C;Yy1>K@<(a&N7Zuz(Nz=K#?Vc-IiBT
z$q)i8H<c20HXv=!F6Z4%4G1)azsRQJU=iRb@RT1jh~T6Io!lE5k7Ao1afL9m&xB=t
z+Qd;Gg3bUD=Q_lkJ=80?NW=2_A_i{oCQP;q<rfJe1_H#IKAhxD*TKvH4bXZKmjT1f
z0B@FKJ%|xEAU>?8?o7rcV9e^tM&TA5qQz05txjlP4oqyK$(7_<a01f2`frsL+KMGb
zgzI+SB)*kb|83TKnND$1E9WS;^A6gcr7#p4^d=;dpq+8GS$9Bw7m)7;7rVXV?mGbK
zh1I<5)R6pqg-pzDF{is@I6~DB@C<o)1_4EQc4;WYGbDJ1V(?&8duR`0Z-rBnTli++
zyxE(fn*do~cB3oW*^(AU=Tg(M9g8IAe2~|Mj6~M@7W^zh7@vs@?Ja;6&Sv`U0S|{V
zRJ?8G3G_bNN5f(r_EA=LruNZZ*;d(yGo6T{t;RrdiuWP(Z?|C=t?IvpXTdC*1aX<m
zC%{4CG#3t_yHNnLQ;#f4PXDq_G!fz3fAKiKYBLC7Dy<w&Y=v~P&Rd*Tg@&Vb^7lp~
z(e`&p!&>Yf_F#>3nQ|Q3!63?_oWxh<AS{j*t$_PpWhXfz9uYIdqkuT&F()3haJy3S
z6#n+5<SBf3nLI_rn|N`m7NIH0Q@}36hu4XDSwJi!VJA||Hd%!2SdsZUC<)RP&WuR%
zLd;0Uu8!$cFdLyafV)p&zo(uXg-{a^VKdJmY6N7pt-%#7Qul*I(J<_iXC!eX4C_tM
zl<*6$Zk#oe851@KACZxKhqy5u!PQ2_bc*A*1^Yu8BtY5<(Zf3%^d{wjQM7rZki3YX
z$2otE-sMG#Ij3cgDMfwZsyhoa8M1JNRZ29!uu8`Qow6sHLQ99l0yy5}$x0}~N%8nl
zhvEnUyGhtVTE&DJU<{GHArc@P3*a~JY|#!^Kt^Xz7ed{P-;MKz+KtD0K&!_K?NNth
zNY3LCkQIs^u>(CZv~bA1UPAkBs>G`;$-w~obqb_oEgo10D(k$s9(6fdhs29B41g>Z
zcc3`p)XMW(92V#;R{T#D<tM&vKRlK}+OgIJ3RXM3I3YS3DJpLy8eip1*xxIQ6ej#J
zvO2rOrW0l{!eA#v4lCB+yC#*XmOx61lB7*!8agC!K_<fS0~e{yOFTpR%#8@TIdhBE
zlE5)Mn*<A@Elz`7A$KshgdzDYHOYWBW?kUYOf@hNHBnF!9iWMRNvlaKvEdMw!l-nl
z(B=S5F*VFcJ2-9kf|6!HQBcyVp)e?E7wK(}o5n^tcmu_k12*bgOPUt*h8e(&>!2h9
zOQ{PrrXV}Y-cqKYdk&tfC2_SLp6hx(d8@JBE%vkq1}|@}CNhoAVoPelNZgXAHN=LN
z96pOMSczLA1-BGgXoMlV<Y^5dTXHC^gzWWvg%&*|f^Wz!nSv9tC10UM80=`}E3|5e
zbaf=XO#ti{a5y~%pjxCB=#c*iKL`6x{R*wjSz~$k=_MaV$^c^94}I(Rz91?1DlO{%
zEq;|&JpUj#0D?<?mF5%tmcB|WCWtrV=&Q5{J6;~lS80Bg{bVJoD*j}p!JEJS@T;__
zyZ&Uw2ft&#O2fAV)!ta;?I(#HK4rbo0Xndp7mC&Z8HR)A_4$Cf#RFw~>44{j4g!+6
z_n`GcrW0f&!eG_*Ao3Kq@*%o4@<NB9$G7=<d;||31%;!Y_c#P7@*cNoDD)mj#d{o$
zp@yp4f#-G)&tX6j9?56GK3H#t+(wRXkHG_u@%w#9cLYdx_;L~aS5hBQ+M{GvZgn21
zF7!w^c^CJAO!_G~&7y*yAibdE*K0Q&pPd;Sof@A$ziC+iZuIGqZCf|VFXIl;nF~`F
z$0tW;$1hCN*v!m@8JfL3Gd*^eW-rjp<>}e+Dg3bA==kL2nX#&a=HAzR*RlP_hG-l=
gL_Ib&Ha$yIqtlm1Cka1PePQMyfkw~k27KxEpL9v1hX4Qo

literal 22942
zcmdU1cYNH%mH*9ZWv#R;Y1P-VWxbJ`gqz%CVN<-uxL}(Su!#d$$o67uRcy;L1S3nv
zcuh|rfj}S-Qb|*Ka=BD4<wE+UT#`$><Werlr8meWx!m{7%x`|PyFbYapSwT82k&p*
zoB6%>X6BWdH}jL%dvs8Eo+rL>>&cUzyk3lnG5kcv$FCRTVv3)V@$vlnQXmw{)PMxu
zx7Zn~no&V1q*A}-{wgsvB9F4d7h@E<m__9F)97DS*|y%{-oea3$zWzM;w9r(qx)AL
zJAC-i@JPK=?%A6eIW&;zTIG3elUZR+dJgyQ>(A`>gxfNYSnojJfuSA{i?~f{U1Ed1
z0|STlc_nUxJQ`Y{l`Fic+a&4I7#Z$8?3KFJArzK(c{AK5EiQ$92Q&Nnd-fi?;fBm`
z&(Xf)8L!N3Tj#dL03Oc_AM#?&TYC2m^lTkGJkYaYptnD>qUWMRLq|t?henRJsj4l#
zM-Q5+y*)iW2Qnj|ePFQns@}Z=8Lxbb_vK{o_uZ&o?%Ci~_%m9uzjvg!2YiP|O2)m?
zO;@5+uYP-WZXFs~zM{M5*vb`{1=N;2bP~$Y7*AAIRVQm|>*^aCn^H5IXU%Sz(@HaL
z=Snf|rB8}@*|WC+NH!J=(l^vM;w9!3R~$PGNiscy#|B3Fyy})o8w~Uw9r2Qji|e&6
z^xV`pauB)&bv@eCJG8&2KXbEJA2K3tb8gd+nvA5^xTv^lICB&eqL|@r#Yr>uQgpV~
z-pr;+nt072Qs|NKW`$Jk?>mseaLf)F=o^MJ8LuUzV&9>|H+yqhizPV73g`F8YYpji
zUW=g5y+=JN*LnoyFNswA;>lZ~C*OVtbYN#>tbDv=tYkbgRyi)lI>r-Y2|OeC7sWru
z^V2O)UKbq`<N9Ch|Bwdr<9}(d-ScF5Iw>otB3ag~;B+!A2GX$s1!R+vv?t4CjLIn1
zg~oA;Z}8T59#y18zpN-(kAk-?x?Z)WIH1@-mf{_r(<qNZLX?U)sK^A+m3Y50o!sib
zpO94)1qR$9gBZxlYN`e;nWUtwp&D6BRjN8mwJbzsT4ZHq2>o<a)={19Qgo^=)l<Fh
zQXO}x4kFb#U8)DfU8*--(v3n`QoU@TNOWw&c<BZ&E*m#^vWXg~B<-b>sxO*A`YCU&
z*cu(jGwp4Pj#Ejg9(IwAOg`)>O660+>l1h6p<;6dko^;9MtNlNo5xi1HC_yI&!m)W
zrsnu`*v_I^`8+^puIQh*gIUbtQDcg;X_joEmbjdQ{?5toZw#o$HC_^rrZw;sLbj48
z2`VQs(9#)b0wns?Shw1u8Fa3ZXzXaB(IYRN&~uxWZK$6MqI1(xt59un9<>3383ZW^
z;TLmqKF!k*&F9|CWmTG+E@lDL0#IF$PFSi7(iMj>sd6E@(N67F&8D=R4(iZq*3O-2
z2g!D)_Z@&(%{okvb)yh*s6(DZ=g38LPTFX7RxSn*^M_#x06Qj2)4%-7dw+i-SuU5+
zGFq7SvgznRmaV?i)-0#xs1deig{@ghD^U}%HLGmRYFdq&5?j+{Yu3;j)I@Dfx2-vs
z&P7eBtyybp*3mlD%&;}**_!j|eAJZLnhR{rg>)fmVzy?ztw~cFHRZNugRQxUE<#O(
zt=VX6E~bl76Sp;+Y|UocjGBb4*<x$9(pJ<|+L}vj%{JPGnkrkf-PY`&9jK|cHJ4I?
zRvGP-mjUSZfy)7$=L1*JB7mI+WOZFcm%;e(xSWk^5naK?m7p&FjpqSa>jPH;xWEUl
zqQwALIJ6ei^O)9Rx{_%vrmHlqjs6=u(SC~$>;kae2d<_i0M|RTme5Y7wS;ytttE7|
zrnSj`<N0WRi4W`saH$WxfR+N>;Luu1&u3aoX*bhaN-tnq=g4bZ)xXwN{p(!S-vi_6
zNeg*>IwE`1C2}u$)C2AJ?PMR|>m7JM+Gk*u8OMF>lQ+;lV2u0NZ;PYy0NtP=I>7Uh
zVfT><u~(oDg6hFMs(qk((5HHhEsn}8^=XK*O!XjBJs3h2vhQ_d?+5Jm4Z&Lug6p8e
zwO<ZVKQN{*1GboxhiFJcbcneQGS|T{uKn^b&__V|h(r0X9Hzs-Xv*>^9ZeI06aSt$
zEk|fr*U<<QKf=V1gc0|s*Xh!+f-c^OS8f91n;gc+<O}H-Fs4g4+Ty6ZnO>+Nx|zA&
z#9VI*=jtlKad35|xCO6_g6pWm^|(Ai$AK|iZ?VOk9HSE&qA}(=%3MdoxE`0|K%W#K
zeNs5I$K|bp#u;Y@^OT@dBAvo;;?d6Id7B`#(JkmU!F&LK5q^uK7y9EW#%TeB+u<C)
zbcW?P<H~Vb$lC>>HL#|iIR_Y(cL+iQT}yW;DF8qU{1!_A)Sb-Z&H^5HDIUNY9@laU
zT^^Np3qrj{(A|m!0I<MsF$?s|wTOGTqi)ad<(FQ>LcGWo;vOMiEC{WEHA39$06BS|
zAT-dmbf1y}0HnZgh!miAKUchjIlaW?bia@<6?DH~tmY&i5cGgZCo#Erbn@grC<u*o
z3wls-0|0LL4dIrrtS{p}yMyo$zw|Im@~|t(%Y=NnAhZV7^!XtN7?qC*LIYh(k0>bs
zKnnbZO5tkMqbx<QW67`JmmXs&9&@F5RLI8#p*65ZidQ&5PQFqQ8t7VjrIG>wq`+^8
z6rlG6SG<Zjy~^eEgpjWm^n_rn8Tr=;dW}e5h>^!b@W{Vb5E|(g^jgIY0Jz~dgqs(v
zzFvn82g|S5Gi29aPYQaSkZ%z52GQZg<QsJ%Dc__EDfwny@Z?*#KyOrxQFs#yF~+<Z
zg(Mf=f<lU3FXV)v2~bPQx9UPlzD*ZA`F351$#-yp-m0jf@HRyag|{neD7-^ads4`E
z3VJ7~rR2MG!ISUSg_wMgE+pl9xj^qy)KGZ0qK3kI6g3py%hWJT|9}yb@54?;{-Z$1
zeLt%La6!=h0AtV~z<iL0_d`5qA9CmH144dS5SjyPwBv&gFe*PH2n}>CeME@{0P}_4
z;`svVDdzE10gr!DJb*PkuHzQEJSsmb2=y94A5|;>fCYYwS)gO@cRTj6qRxMuU;6}$
z@d;Oqj|utDg3ugTBgV%aASXX52n}>CeNxE*0CM0rL=Mn<nkzoVoId4pdRoX&3wl~G
zR&$b{5%d|6=5VbZFoe$vLL=RRKC8F^05|-GaPtUL9ZcuvxYv2(@Oggi3oOeQTv<LR
z<i7|)b6`!cKkope@{5AdK-bb2l^g&d2Yy54$WyB?u^f4leVJeT3d`{oSB@_U`LBY|
z99SdAmmMG{zbXg~bS-^V$pHXz;5S4L(EA!!e4ROc-R1N(A^%O#*92qD=zl}dH*|Ez
zLq+#*3PK~@g1)J^0RT7rhHxt|uWuEZ*SGn#@31W2ab@|IkpC_S&4D$&{<Z^*%I^w7
z16@nsRdN7;9QZAk1E}vYkM9-m_z%ScSi@rvx6tKL`F%mC*9iK)VgUdw@LSBHP_2Hz
zUCr|?Kjhbb#A5u&72^j&{-+=`2iA!3LkGyo9}7YQT}wY!asYrF_zjT*^nSt>KV?oo
zbvgY+$o~@b6Tw)`N&ZaG&vb;xLq+(X3qm8^f_|>J0RT7rhHxuT;$LvD^UUj){MxTr
zmS4HD{6ffI3qo^XO|O6H0Hg9Zg3v(M(r=U;03Zi`L*;lM$lJ}+Z&{8!^ZFgX_IsA&
z_pThj74i>)&>UDJ$L|~<C!Z072D+A>QE~u)9QX~91N5Hdia#=^Kf0Wr74p9YJu4V%
zM*mNO{-mQk9xBTJSr8iO7W8Mu4FI^|H-wuL<^O^n2T}fi7_w3RuY&#}<jDw~jBq5q
zRTn&YN*7}CHeE={(_EliBWl$ip;IWt7;_s6NiLj5Aw~ZqWG+HEP)o`)x{#8$>w+im
z(1n=1lM8f4QA6Q&MGb{J6g3p?RMh?|<XsWE3)EurZe2*qdvqZs@6`n?j=4a0D{3g*
zqo|>9ucC&+ixjm5JX{OHMhi>n2w_V69rk?@r26j1Pk?#}LpD|QQikj(J`e%X2P2r*
z2P4jw=*1EFvIv1PuttMG(*im9P=wGxBj_O|J^%=b-{Lt1>S5;bZ~>2(D;~fa9+1rf
zIr&J0&_E;T5yb-lc;Gjb$D_>SQJ2Sk5&4P;VN8HEJTMv-$jQedga#Txk0~AizyrUb
zJRWBrj~DQGrQ!js;qgF(n`j^>pNJ3|Xaqf>cmMzo{D$$M@;r3>&3BzV=`}>g>Tr61
z1Jp_Xm8uhvI&;EMhCFGEV)=PeB>4IGL7y;`${AEjGrBw+M=;N|o<~rVei=g-kz=+e
z4CRbQp0s?4=QM(l0R@v8E|(Qxi<5@wu}u&TB$#cS*~Y;(?yyZT8f+7Wt!@;?Ho@l+
z=vP{~%e-ThKtvpKRHdI%?5dcn04Uaa5&bB^!|U>*RHZWP46TKCP>&iMfK+sO^?VM}
z1y4~WtJ5()9<jYN))hXuI787%Xr!w9WfHwiI=!p`1WlnDlZ4id!g|RkF&>Us9Mi6M
zExW-r>_(IRtiXXt6G+RHMa-m`?3J1=0w)ga^k!QG4i?y_&asGAYVGhyl0`_89bP-q
z|2oxOA?MQE4zE+rvxxaLzr*X63y}X$vFB}|X7;-cG@HFH&MesHHWG1NBeii|BhBNw
zMq0piBK=o!L@uO=dLnNxJ1}$|>4-fNs11DFIaG}^5aL*gOnW_=1;<&7Xb}&<Vp=Sh
z&=R?n&QaA_TFSgT*b+NJ#v7<*V7M%g;SAr;cIGimp;^EX$$e(Hf>uam^W`e)RMlBp
z#SE7*!(|~1sg~L&XyHUUHgU$GzQl`6AYYM>Dw#lj%0;z%(FtrR&gAePbE$PGV77U9
zUDOgUIpMTe;?*d&cr{72tgR`k<vy(DM@)9{BPrMLBPF}}LGoOFw9B>p=#=aD(JjxT
z6s^w5^QoD-a`FP2O>1)ULYhO}Ik}#Q&dtd*PKVa!<OZAtt;@-aXaSv<lN+gy&S$~v
z=mHkDjxJ<b>S#U7Qcr2FtEUZIS5FslT|I3?UD~6vyuplr=XUKc<5T!b_M`d!at2Jg
zjLN1k>8LEFD3!9mgk#kvUB)I|1~q{U)?eb_R+)4RBgkUwMi4TfVEknap4Y=cuw&A3
z*Q67!Nmp9if+yq2skR9CBA%uii>T$<NXj~kz=11IU4un5QX@}dlSSaTlc#g0Mc}}a
zCw7)a%%<5q#Vt58sOEkpsD`H_L3KPG32NY}s^l|AoD$PauB)V3TvtggT!;0ZvC$=-
zz{#Zxd$JWHL>NkPEUr8-ap^Q?6DP;w+Ng~O1WriKqj@-Hl&U(bj~R(AjzY#CD1FQr
z_>}UrHSvXc3{yCb3``s+kjxP0i{@l-p{mZ(BJR9ht`$vqIkisE9Btxm?~RGOC}ZLQ
zs?fyC9r=ujyC`Mi!P|KzUan2Nocpkt@QBGJ{7Aw(;*rA1B_1R@`Oz+y^P>|E4UcZQ
zlB#KOPOhRFT9Si@sH3Ghc!&mCmV<|AqRyP`rkS)n2M;leR^;FzT4-es9-=~fzzSN;
zx=}%0tQ!@yhIJ!O-8^)0I+yF>w3h4Qv`(A&jJ(;4KYa=&9*K;_k<mxomsq{%@E@7{
zI3L$7(kI0PGpXS2LjV~EMq(9Wt^Oo7CThdQ^olNGRO0f3T0mg^+%FT*RjgmE*;fMM
z^-85#ujob)Jh;kX%)Sz9krG_9sKO#5B5OdW#-Wo0ghP2IRc(ugCfC5sLuf|z%?1xj
zAuw)L$#^L-z(Wck-i);jdKXQ`3fGs<@L<l+H)QyRN{Ja%Tr$yXGAgwp7i+LA$P7$K
z^gMjX*{6XAyGe`}C6qVN1Frg=cJ5~I`YO1oF$#}%cB1fgRN}r?K!o|_w}|Dnh>c=c
zG4?KrTp{8_LH+3*C$4eJBSw5FCQ7V1N>MOPSeFSbQ#=?%Z4v{`g9O#`WH1zZ;?aZ$
zH9*H7KZCK4M$~PkgdKM%rMrg4v=u64K!Vlxxh$ds3Pvfhh{krnqbRE$YacI|p`?{i
z(&%$j(n227m|X-e@|2OPWe8R+Sn=jhH*N~KI#WLlstwa<gMer_;~Ei9bR&Y}+0~J6
z32A{-`n427=-FRGa5b+r>(`nQXwUu{La=#lwtj84Y?;PubFcu@Le9~z&B2wRf_qYg
z-a6yTW|ZF|M(CJr0W-pyf*`a-c{v~;PJlQ;2<ictbIhnglCl~>M3rncmA-o_Fp+2Y
z#wUDzneXedCORpG)T-&EILwv;*T;sn?Fg=R@g2ERs=!^hJUm`0rFa}V4yQ;FDuE3r
zlGT_516EQrnJjdTpW%Dg4sS3ytJ7n7Oq@~I_7Kb<O9bLUI-grKS=CJJvbEQas)_`a
zCTmLda%=LdVu4Yye@*LYt<=-X4p!5uVp@DP&~x3*uX$;V{>(RHIRldVt6tyBBujXC
zt6j>Z%UcdkF%y%fT;8VbJx6m<3*<3EEG|1kM6-&L^=k6``-qd?XDnJw@qNZ54+4kp
zfIQrmCXbtn{pPx35T*UQjJ$$o8FV8IQxSRI=1(%+L0e7(Kp~M}Q$EuSNj?f$27y+I
zE{+~l-Q^`z5XpNBF{C!_ZRWi$?kPf9(_UP{(`j`>5*YLu&}$NhKir>ezz{Y#S2}^q
zQUh`d*7yJ!(Hb~7!5<d)x1NJGZ>#Fyf3fG1jeb4_a|Y)iQ(%)ylU)n|m!(ve8o@?y
zy#X0EDQ3gRlYyuv&NSgRBri+#fT2r#GtyGvjlrxu7<V20VL)7(Y#5NTpjn(sYN6RY
z+%4E%@U=)gEpT`)*Qg}+O~(GPEcb(+#NbnFzicBZ=R*E@=yV$!?|LN#%>`suXY-gJ
zLlO;&J4)Dxlp_JsDi?wV?g3gF3ji4!^KH=#9M?!RE~1zAeAj^SlI_mqs^l)x9#LG2
ztZc^8yI{5aCga6ozSR@fkJA`axB={4{kg@=aDVerDvt(_G!1H4e-konuzC`lXv6B8
z%8@CoD-`z=r?r!+^~FWjZrbwtGO`Y^T-N<4OHxh(S`=zYDv)p&Cv{8g_2Oopbfb`Y
zVs{_7rL(i;w4~ZpOzN(fZIxj=Eq67AyI^;P*|K(_#w#DC<`g5vxl#2f;e;hmSyD$C
zK%5&@52P>IvDM=N$ChHp=Ig=~Qoz-jOW(7tHvuk7b=qkeZ&K%b6I=k#vNtR;3M>zK
z72+lNB6vfgCcWA$9sC^)oNC%jHV~e&L`HcL0ELWyH>VY@)mJ#S4@dLcu`kwYuey|l
zpi*Vb&B}&-R)rc>ed!!i#mj%~x~K42Sh-W26)r&)tgpNRcYTznQr3?B@s`oCM_kdL
z1{b8CshYW9s+bF>kula*130DZa*bj{G1SI0A`|C(#s>C`b^WrD8f-X#>$hI534y?P
zwG{JX2r(pN(&`ZckbtH-ISZZ<OGrzj8IYkd(-w{Da}6(&i<H3ij8(W9&-$%rBJhl}
z*)w9b<a8S$qbTAcWSlkPB5asERqzo7a9JW8kyzG%jNFr^pQx3;??~b?M@8ILDM7kT
z1)LztLS?hmmL=5rQMSz|-Nts&7CIz_w(wyS1S*V@m#I}tpwMc~=O{EE`uM}h3T>CZ
zg$nJQu)u?|CUeT6oK=lI;Us3@yv11pL<G(mM%c^nBGyCBqKQpV1`Xq{Hg?(&*eOH|
zx}a^=w?ScS)`y)eQDGN?H45w)mdstKpcr?7b41C!6w#D1M6JmAb)EddRAL0Ic2Ali
z3Iqr;L|}_Nh0RP&$<{by4=H`vNHy4E>1x@+HS>O+l13qQqY$l`uJ^_s9sbRll8Pbu
zC>29$bqrCD681SfyZ*Lb#}FXbdPtj46~~ZTs^J)dEx)feQ^b&9;Tyydf8mSweOsB%
z!k4|&S-myR(WsHtv`MdDnj|*<l!BTTEVqiH4qIAsW?|I%!%Go$>Vpr{%8+_1H%As7
zc)GB^UxU%=&6(*Pr)tY7GO=Nt%1`XV#-XGXE(p8NQyaW12wC1;W;bE5PsX9(5%%L1
z{X2L&s&~(h4XItTq0VuyQq8oE$IOjaD?WW}vn+j$1$`upl)9-5Qj!F+Wl2PwNYO`L
zwH#S=nzP0hwT419IR-(MIpzl*z|W!~)>om|qrtot>Phg94OJ;;gXHgAV4TL~h3s4c
z8vf3OkAIV_1}Z6yAl8IaRL=yl0*^f_>+E7^mhZ6<#Ih=g6;cNsa{!C%h0Y3i{DoJZ
zhnu5d|Clq0Jq_0fvqMC7cF36>jm7Lp4kISC6Um7a*yr#zDZ)FeEI#ewGZetV=8Qks
z3gD=mpB8d~Z!YRJ1r%K=SV#-`RM(@0YSD=9wbMe`!MZn(=2Hiv-hyPcJV&QH{H={#
zgn6}HfMN$4X7K35V&rcY_oLO2#DOlJ130#b(9(Xn4Eokdf|mMgmgNP#!<nqp8xLn0
zE*zDs@G8??J&hiAQI|fx?(%!MhPq@oEyWjHtEd~NzN^u}bFu$hOUvatT8qQcW%7JD
z=kp!sd>$ZU2J39mn!yDMCGkR-8C>W~IfeSK$E#`ZOgriiT$a*VH8wgt0y4oN%?g?h
z;YaJKmDPVe5!;?Nfeo}?UWCRQ!C|A58t|CI#w?-Ecf=cg4jY-n#t;rbUF@raa#3;<
z=5sUVbCW-xTi~+r4H&2fVgC{Z2S%~Yf!Sqkr|njwwmS-?vCyX-_;hTC&*4(qjE}-D
zm6y{dc?EiPg)>)|12S`UnJwD6dY(c_ybv~5SJHOc1ebNyH0Eq4NbCadUCx{Vm!(}<
ze8^>8)-HcUckzhs3gJsTX&cYkPW62m8eB~~<@52}4eGlK=WBPCQ0LFrZlC&YroKCb
zI#4gbd|X4<<ju#m3J&JuItS+Y*h72leC%=NLt`-?J@|;kcT#((2TtmGx)v+~C)JCO
z9RjE1;X5-Ij>>&-Qv3aZp2A6GC_~q?lgjuej1SD@0f<L?@wwOmx{mh4h7bB$scyT(
zWgooFrhdmyG34|ls6}tGsxf7?!|Eq~4#)wG9q5;Xv;|*@ZBgT;g65%u&K{=2d7V9y
z2S@QC*Z@cl$)nTg@Cc329`5jn-{E64B5$MtI)YEeZp1ffN73J#=sJAmb%;OclE-OK
z-U4m8#j%6qfQ%j7Y>U<oMiolpg)lof;Y&G%&%zZpIS!uVj{XCerSYs98{@OaeGMIF
z4aKIQh#!s7b*%qmv`0^waa)+*F?p-N8>a;L;4`m+=zU6LiR*o10Brmt+JYH=i@5=H
zn=tA7xIB#}ahVf@{|h!UFTWd0zZf51i?M3_<7HnR<mY7QjDmgH|I?-hcB>8!9Y4yu
z6Tic}^s91Uwp;8*tld^S+ODzCbX=E1_J>z{wfWnY$&$ACa{;V|xUB?rlC_u#><8?&
zr4A6^jH@%5dff<vT(n!Nll5SW1km)@;-pWrMJ~MGB+mo3NN*^%xE`Zq(~ZK|PH{jO
zh=^SRE;m>MHd>UA!Ujs9RXraNq^OAx2ylw1(iK|OZ5{(jli(08z#?O={~`c}VGf27
zOFBD@Er4LGJd(3*(e#aLaLq4dNUJFczuSr=AI{j|jXB%L=W75<H8L)VQ%VGfhW#}5
zmr_!VY*X?Dp8D*|N!-ElT|%L!c1DqxldZvW5=%+k2vjS{c3daJO0pS8_$+cqfdKe$
z-wr<87k|VbgpR0OJPqbpWl{$-U!uIGx<tqyfG@^cFG(_)bZ3RLfy+2$-ASERAD{B{
zASq@=XE?Yps8hh5JRhByz)p;|f8wwl5O3d?8{N^3!X|CG)OQY7q{*L?RiXN_It&|J
zwdw-#HIQPBb0vHwAhjz{vaD7R|9uA@mNo1W*Mvv}R5$2!J9MxzcIb2|$fwiIbh<<6
z&<d=h&&4`gU>&_oo(G!eIU}?VkcmfYZPAPt*GM!j_8KcNN$Nh#jJ(?T?@ZR%KQ1YS
zubjb~d=m`VH<l?lScAIRv%oCf9GZ_sCT%XSj+3QcVMgH7d^(HEATtmST1+?ym<P->
z^I(A$bA)3@U9NK1e%_07(|n5K!&Bs@gPb@Ahr--6OrN*^tkWkE1li_sFvw8>IUFSH
zc%Z8=Ge}We-Q|Qe>u$A~4c!Ri9k4Q+>uQ7#++ZYx4`x&cLfHIULQ`Z5&<>o@xQHmc
zAx;NaV3j?KvAl>9+WFV>TlHXrq>*LQ0Ej(hgVAi=D1<a};Ef=Uq)<M2czaF0iODyC
zJaP?|Je<2CkDHdtaCD<E@>AR*35JeOPV<x6JQ4XQ6<eA)a}`6)OpYzMYT{^wub5Ge
zAXZNTEDlt0mfC{rnMsrO4*Jtda5Or$%&|q&H?ENs(l_7X7A^pteo4I6hOujN7J$I1
zJa`}@vf@Uq+SqZlh48{f&?GMaC6)7;HXrGlZv>zU^YFraaGCF{{(!@+(JalyNN5WK
zWVj&pkwyNaSkGu4j(Hapn)3%uy1LPra_FZKc}pYbY6t93>k%%Kg?}2sYML-(ts6nI
zfPyhA{xpJ@a>{IZf$5uq6N!SC*qSxlNv)aL@}Gxdzi+KMpx{_DUndjEL^DDp7x}m?
zlB{j!(1<gssX}8wPM=k=R_mLOn5`Peo{%tB?xohuki8xmP%r}VH8Ly{;VW!tY@kZn
z2=lSuPQg;m9f#nL8P(&)LlE{F737C2d&i-W8|ci0q%)nc*8nJ>)1)Au&P>)TEbEGA
zuZ}Go*2;hHNyrw^Y;k%&8;}Wmvux3f1lLG34xwqn9_9tQfcv2AFI0i^j!ygdz4sy>
zHAcp25Razw;Zdbg^w3lHJVg&~#6H){Kmi3a!IPZ2PsSD&p%s17Q+HPMqDw+WY^U=r
zQ1B8fzGjPn^f!D96i_g|<wM*AR5}r8Z#@9}m0tq@96_n9E&`SRmCoPmw?HM<8}sUV
zA-OOT%TU`6*v6#a1_jNZ<F`SD;}3?*z;M!UgItEs>D!<}hBz7vz6}bf+i!zhl=*NV
zKox#CQ0t6ehyQI*&|G~u;DUd*-v(hzm~i?E-9Z$>=dvaW;SZ2a6@`L1KpuLNUgTcP
zW_xkTdb&6rtb#TH;zjNz<9l@@=tw}pnC&KHvp35vv^j`ETVcnSxOTh^FK!2i?N0RA
z0w{<cmng`O9@{y3Y!BfE)DF<u;n3L%D4@exZ+JNq%#i`l${iteAn~PiDU#wIlH#sj
zcz;WRJV=fgjml;lk*fWOgd0?0pDM&}=UWWIo9o3-3jW)oORpRm&h!rU4INmzLH&K(
zy*(>eEaksSx|a4G8a&)L&^yw1Xoxby!-s}x<k;{~W<QM_qTyphBYlGzx}mpk;Mj1c
vVv~Nhw_SDF#>>`HAO2u&W-v1}LW8|S$9nO1yE21^hHqx5_kgOv_eTE<a)Sf5

diff --git a/src/wasm/Hacl_Hash_Blake2b_Simd256.wasm b/src/wasm/Hacl_Hash_Blake2b_Simd256.wasm
index 1e2c80b741e9dd2ef4e82b2a78e74bdf282d6c23..9c9d3b17c04c1c945b38c334b9c579377d8e15c8 100644
GIT binary patch
delta 3085
zcmai0?Tb`Z7(e&Uy)$>_&dZ&dojdQl&vC|e7hEvO-7*Z%mb$j9o32&{F)hA?<6CMJ
zggUEcA4G!f1ic|BK|&=a3qj-uA?TA-1O|Of{{RV!@I%(`+<SLsc57{SX3pDlo^zh(
z`Tc(P-g)7(mr`u{_#urkru}kyW`@yh>JdHMniT`#NK5_AZY$_|YxcT3dvW>o8&ccy
z!3@mu(U=`iBvVd0lkLg5`9iT&u2g&b!k?(saEpl<&BpId*7<c**Za8<vm-yh4MSH>
z8)f;C{(Nisn0RWUF(#(Q8lw|pe8cL|#?<C5Pp@7xjPc}C<Bic>J2p&(wA#{klRI|=
zR{BG%#y9K=tU~pUuT6^&oe~rC-i(2c-D0z6H*BAp+$tslm*(7WdQ&s@AKrIFHjHX`
z-?6=WSp`9oUR@zC>m_;7Nb0?-gKlD^F@1PX<JIY7(}#|;zUZFm*QOiC_rJL}6psD+
zol5h^swTRAD%=umfH58u4!6mcakDJf*~!o-8<CUY$~x;{lj4JnjW9;G&<=20FmCZE
zSri>+EUuZFZBv{lYD}=EV={_$4CZFd&votA+&ZgQO9?ojq!TrXktUej7p-ac=gvpR
zH2Gs}P34j*o1veIw={hHOW7zkk5gQ7yAp}=7)2>2uUSvDf_~=$37(`d9GeG(b`YN?
zPf?0Hl;mkLc_y@;GJ=g8>pj1e#z<3^O>)}ZA;#7sNVURY%om^GZ55i(4+{CfPCVIJ
z=UK`UyQ)%@Mc$Z2S>8j204Tk?Abr%+Jvza2@@BLU?{eX)iN3ChJmmwQdEaNA7Z%$T
zsTkN4eVZaLEw(9BIj|}FHf3H}Y*VFbU{m#Ns=Qa(bmf`%QD0!w=iBsgB6m@gg#}Tn
zge<hMsMKX)ouC~4D_v9U9430_Cn8Ox?j(`C6f3NBIVX*Dp;3sq0#b>Rz=tp#3&`xQ
zmwjIjCU@(C&0R>oq2;azP`3h9MF<F%m$L=As$#E>0#p_bB(GFMOj96OI0am2n8J!q
zs8D+=_(BXAM57NggKS_mMsX)i5!}b*VKOO<b^H6be6nTaH;w=ilp}Bml#2n-Ux0EK
z^R~>Scgio#yw^XP{z?9xugR^Mt>6<eC&Q5{c`Y*%eMb=m%;oZ4=5ekoR?O$CiR**K
z-D4)#yCu2Gv0qG3g5oN;1lcN}1jW=n6mvjFVR`W@DFAc2^8prhj~N)%eSpq0NJy=v
zIN&JvSxPJSS;{E)iU|t)zI$*CadaPNaF=p|ZN$fDK~!?{{LQ1blsmu+l;=gHvjh$U
zUTqE+F$y?b!m%xH$YH?^ZjwP}M;u&UM!GAM<5f7Rb~&kF6gVljyMYj>6%ONn`4h|(
z_x}3okCS!@8q@1%W5i3Ju#~6_01LeiR+9??2ZIFLB>vWp8Z8883TAVXmrKB*V{?v^
zmf?EKgtK{Gr!d!~WljGCIhz|81M;n5=Aa?yO@TPCVP75l>Vn$)loV6FNmvVTjZqL*
zU1&{Sm!IaAXKx3@usg(%N9x7=5Yv^wW3#Vc3RN+(<WRO>QKke%RuE!n03i)cRFxVJ
zfi^Xg1XL+%Bz<ZmfhtBRC%2dyU!U{Q?8^7u<vE>O%Ao7qC`IIh9L{wV+iZ29;u{Xs
z&{*nR&<;!jyxUAVnw~Hn;MSR+8BbGM(T<U$s_GzLP8ST)Y8nrNbdV$8=s!wNX@z#b
zV!IXM<6RZ@lw;wPryN<~DTmjDC@UZtM*BgbZsn-SwJZ&PsbSWms56Y(f;#hOJqn6&
z7q@mrrCnvrHOXyy^zzjUqaXqoRhFX14dr-V(X&_}5J?rJpz2~!f#cCZMMr50pW9eW
z$D(J?1W#c3a&7S8rD!c(3WzI8fwUM0LHZ`{2!T;!|B3_50TeppK~_+O0w1oP8D-nZ
z8D-A}{0L^R*if7l9?1sJ;w9sjfwznjqws?A*mnag$NnEjlS^M7J`>1tLWJ5`hFCQz
zftR3mr7;S!oKRd!C@#sd`kvYy(|Z8|v3ZCacuW~e{AbSkX$`9v8~H<hv!~e$QEo3l
zy{Fl0J1$g0mymAcP3g50DWT^}rxTJ_@{eurY!BYi9Hi0W89+FzcJ&}m2y<Icvls<Z
zm}z%|IMoX8dAHvU=TL#WVOi;4ss9;~&!BlPDo>j|3H#gg2vcJ<X5Wa-ec1nsK6hcT
Kq08GVUjGNGStthp

delta 2358
zcmZ`)U5pb|6ux&lZRe*yGwn><o$a>gZbRw9VwBZIiA3(2po?PAMD#^B&AJNR1=IzJ
z251FA6GP(Wnn*NJgHaO_9!!n#NlkoEq7S@~@Ti6t6XW88;RV!lrbB57W`AbRJ$KGM
zKi~J=v(NnYbe1)j_j1M<zwmme!>TLUyLfzMrm=D{w{pbg+R8ikeDTvMo_Mc=-hz5o
zEBJ{w>7BQkJa5~{D{r9TRFu>M^_}(<zZ>76`%i3^C!c?LVS$Z?uH^jw7hh%Nwc)n2
z@r*V$6}_g_x;w0TbD34l=b8tabIW^PTZnP%^!Ie$2b7bh9Zj?)YcQrDS7;kc;d{%`
zBoj$tKoX2;#)J*_4BNyQSduRaE4CG1*dzMZa5va!8A~m&C)mKIp$I7+=Qc(WsTz~4
z<-{47LmTYt$2*<wr-@HA{$qF6tZ>{68OMwR1Fl}NYW!;Ved}SaF56S(4^Lw1x^^_x
z=J*#TAuQS9l&3mvmem&9R!=53se=hG01BZmO1^}@Es=qY$U<5;pexUsP8z}l159--
zCDdb%J(YtTuya&vj!HHlC-M-JOgiEBSR&*Ht;51o7cf1a{(A)|L|+$rUl&9%bd;bJ
zIZ8c8NsNS!0D{O7^c;a04IO1DM~-sOQ5Iw5Xjh;TIVwFzMO4ARCCB1Wj#SR@4g*F8
zb{L1j!=KTCC3XTA#s(LTK$T4OrR}Zr1po(4asWs>W&mkyztkOrfFYuuB694jYD;#$
zdnS8``)4D-8PUWNfEZKz>$UX;P9TY~A#Cvm#y4ZW!%J*4<A8B#|3(WeU>F@Ae46QC
z;owcM9TyUKx-R0NL!3^3iwJ}m&#OzW^o1!Mf!{jGKsr4<I5D*&x68a~t(JBuH-FN^
zVwMop=>IyuGY`zk2_HOBK=}Tw6Mog@K&UCNVE%HVcScn`;oTSKcz~%sD%RD`z<w|V
zDX^)S6j)S1N~D2fp~y4DBC?L)I9NDBbI@kOp@Q2kxR9kdE;tm&6$sOQoDCQ!KNMFN
z9-(v_{_1V)Wc~*FeH;_y7exVlfe;ZTq;g?^%0;v|ais+%I*%+-P%D9Vzb8g;00HF1
zD1L-c>GMB8EBa`p|B6Xb0P-N9f35r5<8t--SAQR|17u*C=pRu^8og%dP<GIn9;$1M
zF!+%Cm%pU9G55G+wx}p4Uz<iS3cyT2I<q&F2-jKwt%2ZZMVWx)Edf-@#ww|r168OX
z(MwPj0%MJ1tZ@nbSfo=h-U9SVP(KtJYI`wfeiMP%QVYd3IBgUU)vVXmoraw!$-*%+
ze3&#PR6CqriF_N=fRiW4ra>dfrg8EN1<ohni?~RjOeF}iXCgTH>VeXlJSPqAcZvob
zGGK%lfM*Z`3_1!KfY?U3DLGPC-<q4$yMb%sA-I}_Y`FSpBV3I+!leezlhWA(%??>N
zycDu7C()xJ-tZA4*irsB#8KiFhZZ+87vp87nTHQ|8rzD(84k+B0)1?*FU$Sr;#v#*
zRw$)C)}s{-%BMm3G^iL7j__Y90s@n|SL_kKC{RtI<S5r0@5V=6%lw1pf>(mAs%s|x
zuWjwyv<*cF+lFlj`QF03kfUVx(rPdVCw0@FU?plOLh;<O8TL42XV|U?n$ha#Hr_26
z;YwZPP%SRS!`m(tCUvd8kN>HzH2n1M$9nlD@CvilskO6+B@2?I9J^yehZyKsFQs;?
zfZ)-j8YE&Ux#6wm#KN3H!exkX8EiM|NS~pkD#Yn*)Z*SI)oFN{EM{v6)D@A#c*-hI
z)<`ZE1?q>mnMv;g$C^B>X*H?-YD{X!O;w$ktbJ_V?mo9Kyp0udR%7;gySs1V1ue6;
lxwN!@e(uno1H0!I7u4$Hz3Q{cZQYCO=QORktgcKR{0}T_uOI*b

diff --git a/src/wasm/Hacl_Hash_Blake2s.wasm b/src/wasm/Hacl_Hash_Blake2s.wasm
index 8e69e8f79009ec683e00f949be0a3edf8511e7bd..814d98984084ca3d4daa6115489ed1c01751760e 100644
GIT binary patch
literal 21925
zcmds9cYIvOaejL^5C_}=I8>q$oCQD-ETAYBP$DIYj}j?Lq(s_Ob%Q_(q;LQM3J21b
zVv&?&l}L_k%SE=FII-iFLbupXl&UzrIEj-uy*P22)0{YV632F&@7sNE-`?E=rTCxt
zmp|}sXLjGr?Ck8!?(9AUQ{_`C2m<x_2QOR*hVD}5)Hysd=g;4z&Z|p2>dv39tX~1d
z`E$fYRiFW&o@f?Wf6kN|h_OZ1ns?0Grq;ezLBmM09KNEZZIno!kd5WYeBohqw7KEn
z)Z)~s>AAX7)2A{)F@HPsaP-XS(+i7BonCqJ*!0rE-1Nk@An=>?r!|>8J#~C``tCsa
zEh~sk&CQ&gp9Hat-=y6qc4}&FZsB-P=QpUJVFlW{CCK_siaw2{#i`Rly<eR|;qr-K
zh2LbAPvQ7I)5m8gkDWPjVtR41Jahka(BQZ2@Y_Ox_fIb_1i8KgQ^)5fZ#Z>&ZgTJ3
z)a>+@$!izp%S%)9OXVR`bzrJ|PgHema&q$I^b%;FJT-O8)Umngpz#v#>*d~`Icr{?
zJQ_5`BieNL)Y8->_%1Hhoe%2XegVV1GGAzJX)U(3cXW1juk7jV>mOJ(xLWjzce8fI
z`5=5g$m1#Qkz>g`E~tFNhaN$*?(S+S%9AtmGfP2Xu(smNX^1gBdFssE(oE30YS{*J
zQ{|<gxavT7?V-s7;n4$=dk=*N_iZ_f-^14)oZNfoE&Gnvss7sf!?)fN)n-y^5AM4&
zs;wKSefMa1D1JFBwbe)Vz4Ykeo5Mp9h5C)P(pxi~eD%!IJurLBr1Ip{{N0nY)At3P
zHG@^2^qaFySI=@JgYFHrRg2SQ*ot9>w+$!DH0Y5RY8~{hT&79Tmm-B7x1c|z>h777
z(-^FQR5LiS5Ufh6II%cA9So*a9A7wnU$A<0t!VdflEhsNWc>@Y@Rgw(t?6UF)~#rI
z?p+VU@GpJ{mYd0(dvoS|7>oshZVHP!FZp6apMk?-sOG}#oB>M3Oc>~#Zj_ufPM~o?
z3SoeP<U=*9^L2Yr2o7fVnATDNl$|R{0d$i_6%-1pUgh&r(9J-%;Qf}cctiYtvu>4o
zV89(RsJW6ZN|7?QNt<q$cHJSZrn)2@q~8*%l5R<%A7*u@bh<8OFV&?k>9SqwWS2T2
zQm5CYE<o&3SJWljD21hT>2Aqn&xhyh!yvC$N}VhBNVjA^K!Nca%EiY~&Z4|>BFN#V
zXCf$w(!CPsK8!^_B<S}f=mVr?jS#)A7)iq#jmF*(MG6kWg6(uk51@V(h^`8=PSXQ=
zPzH#ZD}fY*h>K;tS_Um7t10p->UdQO3!ns4C2Vq3Q9d0O=d?yQhGfX;|B@y(EW=j+
zL+s2DNDg_u9|lDI4@W(=jZ(ysVLc)vdX0>P(QudaD1cn7hP42kPR7D7e&ds0d7#*+
z*U383VNi-xq1U^b4YC0>%GGRiHRCdlnvAR2<Z3RH%TQD2YBsx?%jI&^WL?b`SF=^N
zqNd)}Y;!f+WjktCxS9!9vqN^Eroq)*;cBjwD^ZhkH9K9+F4={eMptu{tGQaPMop8e
z+3jksk!w(scQt!lO(-F13a)0atGQOLMNPA-xz5$>lYOXZaW(s0&Gm9UYFb^*0cn;^
z@sQjAU`q_#2w)-x4$2yU>m!inx<+o`<XR&)a&oPagPdH=vN?X^5P)qla1($lV&G;O
z1-Q|pH7bWlYgBF`tx>tz(%K!raTx9Q#=sE(`(xlGvKHV@kJef_Oj>K@2x+aAmsnbR
z;x}H3_SeP0Q2+;G;1(GJc$G(MOkPS_V{(+V#^e^#8qv4<rhl7n`nUV0e+MSdouSe%
z3p4uVVV!=31ac>+$MfWsfM4dpuR{At%*sj6eY{fNC9fpLx{p`6Vo6WQT^5olj>jb3
z$7ITU1?m{69;={w98`g^RBv^~lD=DxTS)FE)nlZ3EQKm$e}yOeG+@7PC-BNia6Rd9
zo!0lrG%=Rz30ExZ8M((oGDEH>$@OF!*J)h>dKQ%7sGU13={YG8V<_uWaw;sI<zs14
z&&!;xk$IAyCF$8T(t*6(>(D|~2T$Xbd%^ZzkL`k9lm%jJhfcd<Ntb2OLQ*Ezd&%|Q
zbgsS$EP<;p#TmSE7F^GIT$l8#Wr-Ne^^7Z)^=stS7LwPH>sfL=o5poX-v{*lpnSha
z`9A#}avw2Pjjxs0hJ~|ubV7{}$amNpd4QzvC+YjsNLSjyIdsVHAeKV<f&$+Q%42*^
zKd9uK!P!ooPs%0zkP=k$1%#)E6xjm+e>`ggGEfhb!NZjdUPlJRSq8Ty<&u6x394<S
zJYpCC00TU08K6hL<v*%`@J;_QzVtXnc-$A^QKi3A30f0tg?P*Z%K8Z<XkcsQ2_ppn
zNP%aH6rlGcD_&1dulG4Usq}X#c~Tjy9m=PaJf*_iSw4F(nr~2oCVUGjeS_fz0KD)_
z;Z<prZ)A^s6}*WrJxw{D_T_k^(r;FR*2LN#zsUni`YlS(z}CuJj1&MM1)ix=_?Glm
zO5x9yxACQCD8)0r6mM1f?Ml#^SS!WbJfN)Kp#%+Vt-QlX0RU3qnIZ+~J<E!BlG8hV
zPR}a+-AbNS25a^HJxabug$-x<?1kRnr36j*7WDou!wUd-;hDlK2;B<nd(quwiS>Pi
z+#2iMO1@X=_b7Rf8Vj=e`)who-)jp6{XSa=^!r(m?>CH5crOZBV%~>Bj)nK5P>}Ca
z`U6Tn0BSk?L0c&3AFzc$|DY{o^$)QiA2ifZ_yI!=g&#E3Q1~H3?cGZMu#z7JwSvBA
z3xWQSEoAkFZ6T*W!h&2h)KK`4p@zbT4K)-#LTXUcN1-wOF@>o5BMM>l<1_@|lEC^2
zV$dMLe3I(@QI6P;`XlxUrGHEbniFen<C7jx($6VD16wQ48PNb>yzs0YFQ9&$Jbt{2
z$4?j@#9AJ=n-->A(m$yL^|n%e(y#yk7I@aOK*v5#I`JCfr)oO?(|qk`D8|qDV*HfS
z&nrQ5VyzfI?Ez)|vr5pw*2>QsIRHQoJX7QVy-%^?=g8^jd`_QI`sbB=N*S!-q<=xl
zFDQm&J~0h`Q3;yxElh)7G`s+S7oI7+0>MBhef}l(xk3xS%-4Q}lKhG<$uBAWt4h$E
zSlj1c_JET9H6>_ZYvtFB8~`8(o~d$F7}c*+jta>>&DVZ|a{Pub$FD2>n@Z4}SS!b;
zJ)o?AO9>j-TKO#_2LQ-{XNnx4_Ze3FHaY#a&*?Kt|BjN+D1)`S|6L`&s~E@eWFY^n
z5;Wmk(EVo(F96_$X9};Xsr7s8^T+sdY=OVe*ZzQ#{DCjY?<xI<O3<8G+vnf+fRg?r
zC1_x4<&TUU03ZjRwQ>OU$K>(HRXqO0@F3RmxWlwC<&yqWC8)QR@~4Ic0I<NbmPNHu
z{TaJj;aC2guYHbUe9jl+&y@ZPC1_5p730r6psfE=2^!d1`AZ`Q0LX!7iX5Q#c~<-t
zIsKK->GMkewUW;(gEgG=-zfPT6WQ@(WdB<wXu`KJynkzW0RS&NQ+QPw@ZZ%;tuOGk
zzo#UB?@RJ`O8<irG$+>f`3oLU(*LLg4Q#Faqmcsu<iImkjtZmtr<$qt&wTBRl;exO
z9RH;BzbHX-Vyzti>;Yx{uS(Fs*2=#cIRHQoJX7QVy)Uui-^l6Td`@3d`pZhbqzu;T
z{wqqpVxl{qjPC!g1WouBbpP*$7Xa|WGliEI-TwpqO``jM5^~Y~t4jVu>HkvlUnYWn
z%@zXvbz8{lZ`eXk|2GTrHNzN%ucMG9<{K#FSom)g3i6*ye^bdfO?1DIF@=JD&=vyy
zkS%2O!z{>!%tR2d@E{6V79K(&$HK!X6y&Q)zb+%M%W&oKh%Mywqqb1ckJ$ni#4N}o
zh8hZw8fqv!W~ia?xS=Lgm!xS6%jb+hwXxrMA|ru*5|0G+dO|J@^<9LV7N5$1=o>N^
z)i-3koyT`(^cyn*%EVgx0Zj*#^_wz+1{NW2GU5Y(ka*UPDNs+7$J13j-fVafYk5F6
z2bA?&GJ*ycA#X7}0DuRcsXX3F9&hz|Jdx3F%LsHrtmOf1IH0Vb$p{))ggj$-000j>
zQ+d3dJl<Z#;~j<vv6jbE8Pmi7W&LbM(7@KpvxWx%@W3;Thcs27^AA07!DP&LM+x(W
zFsE~pbJ<NZw8&R8n{E^4^?C*J*ehV7$ecHZ!OkEMw3^j92%qz^o5-ufa7xlR9(aww
zKA{lha~qMT&sF5<FUi*A>B)B4JU!VKBDS_s8e5a6N54XPk1)4PCtHw-7ji=`erKSV
zm){v=>`xt$oTDv!gB_Tmrb*HMv`LFJO$43zX`aB*O^a?tCz127)Gaut>K3O0Hgk;p
z@~kdGw?$94ZGd18(gyMAENr8+PV#Iaz}bQ~XFL5V+vU&L?kH#3gcScukk&m8(JQ@l
zH+>G#Fa6xB3^>FpS;g(fphK*d)nh?Xi$iG9V>mGzatNfy$ATU`;t*?O%~&v?N2QA=
z2LXQisNOCapablZLAt+g5!Q9f5bL^Sgmv9AYPTwDp{liE#wDuS6K6Fhtzi%f*HJhb
z=tMKSrs81?QswOMdRecL8`m3=dSrD;Hj>v`PN}si`UPqn496=Nu81AxrV55VXqGTU
zHk}MN%Vv%Ax!xk1Om#`Nkl{EPj;An`cFBa_RQJL!;~D0bJQm|Y25bEaL>*Qr<+4eL
zwR;s9O6tx>tqXEEy2(}J%#n`w=6F!7=Fw(&aAexqqpkeO>TUeV>FxX}=n4K5^$z}Y
z>MQuuqp#%8fZi!RvbC&tNuO*h>#J~fv%RdZ#!1aYS??B+9c6uu49OK`y+=mm%CZiT
zuijbKd!<8mQCS^w6?@YmSF-~hvYWDW$~CO(ls&BLl#q3uve#ING*qZI|H;R!8=Q#T
z;0jFD25Gp&RL$yo$x1y~&|liA+Q6yW0CNC!cW#&iL_5ksHx$S=0{etQ<OX>Zi6cvY
zs^<NvTJWc8vzs$;P*i)XLzr{LtZs7%oGx-GIvfJ$ha8kHhv=4W4$n%5=#d@{RIfwy
zNgs!--ysHMfP=S63ew7c6{L-dF7Wg+ho3GELNm_+1N`)|u37q7*DR~dAm~A;YS5cG
zjmcD94g2<|>Yz7sU=r-G7R`e=JuEoYGb$b?uR+e7!4&-hH3Ehs6%5@}T~ooZ2hEbH
zIx3@NxK`HcF&TraFb8oM({*GxLWUzL45iVdiD*;-VFR&LfiP1y>GXKuO<kW*G<AJc
zJawyZcIx^h&D8Y~$<%FR57!HRvT%U-$?1*!Dd=(j6!j+lbn46a(*w7Kp8<HTR#{($
z^J<d~WxW-1Z(~_+gQFfVW9F}vO=ZmdUb(D{ncpv)%b5AA<nl6Rev|ccO|q4i(Inew
z8BMaCR+E<rDmE`WSeKV8SeKV8?bKaSq3Zm*9>UbkX3o`}SLaql)3-5vKDdZQ#q&YM
zs^WQsdb5d6B5ng_Z-eB(&L02&@0S$`h2;2O>NKK04*WAUk-OEzYO^qEam8q<;-YvB
z&1@L#&z={W5QYzWYA)vM4H(2=zE7Ib;V@gobq1&?p^^Uv@BKhUS*S=wD&jiOTyc<k
z7b@!ni=`5X%w2pf)B)AAY;{)B&7u%`$Pe?n2zG3&aYaHWcPOk1C{hJF{|pDIE_1F4
z5}5T4-oxNvCFfjh%HUvKh&hBsQ~>6<Q^CQ(?qXIK>h|!ihV!w_L}NZSM~bwKAVNYR
z8k}Yf%nB&3em3q_tF&TO)`Dvo^|~E&+daB%fN(v5q>HW?@nDTc<60hB3823Yqb?<N
zm=rBkR||S<Mu#d(1j~Pwqk~H;4YBbGFKEr1K=6EUnih=Fr$!In3ma$x-+F1vLwP<P
zuhdIE4@JR9Bm=ha#l_Y>3t~j-;CHjdVzq7jHMwJCIDPEMaN1l1*9;h1o3rGKEq%D*
z5$w07h)#k}Uh0c&^)@EJAPq7ME)tuswt;s(Zu>dvVk|5m3bOIw7wc>^<w!3ZO*tI7
zXcR6PO>tABNt$S3m|48{1M)_j^e)t+Zo+_5vGFAx3e8}hhc`?bVZ3UBHS`biFw08v
z+%1?ln@PSI<YBjtJe-0d&wx$xwow{+?iT2!Fx@j%dy_;I?j~R?*no4AmSQhbfx>1*
zRkg}+|5B6!y=sxcyC6lFe+41lND71NxyHm*AJ`V}{dB}4Av9KOmpqYhzesnX+g;w(
zC*W|&2)h-CS~Q{pilptL6Tu~=S`BydR#p*9wvLNCuz%{*-SI{Z!?+S}^nguID9(KW
zSCXERbi0)UpomQm+4Q8bS&7R@42f2UjDlF|I11x|()|^1pa;B;V9Cu3M0TWLW6P;!
z5X;$qS~adFaYS$piK8%x8%e7jbI7WtLYS-u!p*rxluZCD=^>1X$Sf8=LuT!<2D%vb
zENui(<hj<6Eg_8twQAPbZ8c(TgS{DOjCnNH0*Yvix?-eH)@U@Yp%=nb%=II9ygn?I
zk}(fWIsoenSyycC!>XVvkbjhSvf&4Fk$-5AKx1K@uG%Drppk{(0zBH+VZhkmN|f2S
zV|7H8GuiOMMBygHOi}njvj~B^ZGuDXfLro282L}X&Pv_xyqah<NtfE2C)hMl9^_7>
zfd+vdP&$OtFc*6*L!~wq;!!c)j8vBOW^|VMXwYn<ltB}Evs~=WUYM=%a%8)#mm}Mj
zi0zB=a+h!^^m16yI4@_^R*5nL3@2|q8-MDsw!-*jrD!uVfOf)}m>(oh==?hI1LxO6
z=NAvyC8S`e@4yV{2nU?U0S>n{tz)xk1wc`+JLqxXF>7XswDbOE7)Vg;)VQEoJrCX!
ztq1BNi-PM7gJPH9SJ&w*BRgV8{;5Z;;py1$FkKK$-9+G;oqJELIp~&35LKImUF3r4
zxv;!Ky>-d-bomMx>$6xdm+))|fl@HGAbA>cvovuOxX`L}t5|3`;m8cy_h8<G^@YiB
zZS{h)r~`|uBAItc8<}@VJDGP_4LgfLNU9Jfi|ee2Inh!EiKW=BuB2P-n$<mmumFAc
zVZaeJTmbI{6uHDcvL%!rR=RaRCi4Jp&aMItga}82S5qSz{jL}p4QtGW)MSpwOX|d}
zw&H$kqN>EL4$`e+`QdfjM3<^4j(B4AdI@9K==%`l9`d3%a3vWkd8`3Nau3nihtiB)
zb8}S`En=d$HbH0vq({8S4FfO92rj}pg8&qfUUqvO2Guj?vrz=eM^ge31OyZFH;Ec&
z?iox6#*M`Mn<`-Jk77+#o4*%*u!W)Bb5jJnSNLh91$w#VOS}v}DvAri78_-->XSfP
ziz}<6%yW;}$=;nz_KKd_i68eQ6HWXWR_G}mK@20wv|P^;yW>ikUE)3*UE*3l$DaKk
zhKiK*Ih0Flwnr15@Fsmu;q9Ip_6FDQrXbVjj8JWnjoC(N=8N=stg1^)7rG(%N;mOL
zgsMcD2!)tn+>?z^2o8);9X3J%VuUh3ZJ>wHgr%>vGeW_iy$C6|ita{FyS)en92UeS
z#+zt?1Ssk?*3%^{s#79V7uVM>=zNhQwCTMb8gW*7c+FpWVZBu=yPAl`d0FhOj%W`)
z4I}TgX$qz)8t~VMKYZYJZnz3wolJ4NV~l#Y4!NmD$z0rfUK$^`4O^GGdN?d>Xdl`e
zyhIxJ2De4~nF#xVJc3|`UcYJfChm6a2GMgGW}6*RXH0G8w%g;zwNOkS$3Tw0#e#k-
zLSkziV2Yv;=!)20WunzYVwLR}{3tNM0HUHDD-05hfx&?*ip2fI!2$6NE(BQz3}?D?
zPu}tNPRZ9P@!pA6Y~4i4-YKCGWm8u2Xsd`kUpIDW5Udwr6MLuVGmm6vX8e19$=gRs
ze{6;L%%fyJ^Qfi{I?>@0(j7MGfNwn*O1;tH=N$29aCBCCFl|9Z+~|lmIu?u3(So=Z
zEd)gL#Rv2dQpkbbb(iq10k&AffRpVZw^j+9)oVhfM`=ML$O{i489iET)obl0C=S|s
z45Q-&fq5o&65%1rI?2eoS+tthIEKRSoZbM`hFQH4Rx>V2HpFJMsY*s1CV4UidUFMw
zMV@wpp}R#k$Y!}5S{auu5Ob@nM!I$ra<$u#sNJY{)a{WSo}-)q6q)39S9B(Mg+Xb&
zkY<usz6ev?iC1@l=PqxZ0bEITl}ryKQ`{9B%Ptzrt`vT<lV9`{@gtlE)*P>ro%(7t
z-VF}BtCt(QOM<#+BFpZW!)|ieox%aAYvMsQ?n3XusDv1mJ@KgQh5Nt<BA}YAIj%Es
zeCAlx`#hKix*s1_#O`CiXBHL<tGFKDm0TZlI3S_EK@R8}Wsg3HULEwt>PA4(Sl!@?
zZmbR&l*S8bV|A14mpyPFH@}E6I}8#>!25_dX26x?NC{tgIQMZR*60yx^hgR{IV}4)
zW{2fwJ6<o5!}_IYcofu+R*%=wlAtagucI;bqojT`g*s5TU_5S>TPw!nHUlT)ak~d|
zJnoP?+<4sKjfcfzJnqEJ^VnhBA$P)Iyi9Hb3zMcZ4&&vxBb_*i03V_Fa8|z(4&zl|
zBCo&~Aup5L<yDx8ld)~t<cYouGk?#l=Q9X-@+7s8Y05N~DeF9r;S&-%kK-15d=_7r
z?A6n<SB}SabfQY+llcC_7nz@iBybiViyQ~Zd0oP%D)-2Y+<~u3N|1V1ZpU{ZC-C{l
z9KQOvTQ6Yb7Cf7r2Nc=lDOYqhdD@^fUP!aadtZbtF5=ZPc$Pg|1g<3IlIdaOKgzMS
zlxZ#H6n^-2<aXNPBD!W&8@Z4rS=49H{w$cBtv1QCB|%+ml4oNk?i-Mli1z9zIhNP2
zVMg^neEflxx!3*tm!8BbD3>``z>23eTJ`jNTP*uAo6Iqc=iQjljupW0i?xn}Ih&Yq
ziM<;#F>Y~Wv9R1WoW8Upk&YF#I|<_2oIFw&_9k`0Et6dhVOX#tatnJdl9<28@wUm{
zxg}GwHHeljNWFk9&b?n8Til1Sd3`LJXQNei!WIi4!<KhuD4T7BajjvylGy^gLc2s>
zAD3+^_7m6{U}0T>!bU<>p-f)Cmj~}T)R-@Cdy&j$M!?PkmnuMRf+_B5?11!RfrZa!
zp_$dt>}pT5gMcuTsoYhr7<HF58jWkaTa-39NI@1DCs}ZtOb7E63t+uPas}3o<74d(
z<c5$S8#eMKE_DRyg2W#Mng{R+oW=SJ$Ma!;1=y&F49i-cd|BpWRixH=U1tt#y{z*{
z1z2+Va29JXoNdcSSubNK4Hb*_c);q8d93kJa5%on*^yW$n{K{lp~lhNM4fGdk~cvk
z@$u7TL_@=uSr-{KN>l7*+Fl&mY>&3^5)R?h#&l~MHgs1yw}JR}NU`0!pm{kV9@7|E
zwi<|EQq!`x(}8YJkqD>>(3$Y)Y$4?6Y%@?yXM%JlQs~HLTou@%ufW>sN*UKXK@$r?
zr=cqWMFHgsSB$j98jZ%aX1F;Np1k5P6hob?&G6AM;CLi6xO(Kn3U`ov80*M*>OwWk
z9rW;{;@uqJYvgK9(QD)?ZuzglYH^RVGnh^F9@+dy8k~MKeOtJCD6tuuZw~8Ru3Isz
zHsfBU>jj`l^T_byen5)m!<ro3m!s@<e9BXgsIr2}h{7nNNP~fsaq{zai4XI$cQF>3
ztzm99i}g6-hdgyjzWmF);)P2PD-cr$BPA!y6K0lqvOvsv!ZD;(rqY;0M*w$5#2mU0
zUm}N|$i}d`Ob#865<#_<&gJ>QPDz}8Mh6*471HEeF;cDG9ARReUZfa}j%`$-jVK86
z*f)n<M4Rp)qfQV)qR36Q4nWalYj?$nsQX_LNjIWoM3ILY6gZ0GkQZUrMo%Q#XQSic
zgbj1?j4QZ;W_*lolqPStUWw3zyi+B4giA}_rsL5I1X<S$=Ilux_g4*hm$R>yTo5he
z8D1TnleUPR{gqjE&h|=_3C@)$6P)|)zr{fG<)M2&jt3H3iA^}m5bP`}!6MUv?8cxL
zXh5TjNL#or3ZN)B<Ny3b#i+XkH5z+!AsVP<GDTijhw$1kcny2YYv7QmFL^Qoii~2I
zeqcC-7xE&w9azLqBhT`AW*uF+hIOpL3!~sN>aDMVE6FGh1)z!OWNkF&GD<Ft_=%*E
zJ+I*%z3PeoTvhJ;|LlLl6mcZh;+6@utK8%o6{ozlXxuiRjsBHPGTib1iD`|7*fxSf
z5(<$*c(tin>O~a`To19x1H??Ry)P6@{x&C0?W!dqW-o)#%-bkV8^((3xOmk9|6%-1
zdt?Q+QJOgXCpSEs>qu5DUD6EqfNL>yZkVQ+;qlFm<ev?6nkj7EAN+)!(8+YRH#-t}
zWBb;<khIrZk#rGqE0UE4idQ7Pv?}<KS|xVyMhK=oZ+@t6?KrPmHfTWXiUe0OZK2r~
znCkRI$batj2wPYe+z^GVMoj<cQj?j#wPuuD{Ij`iF58y99ze%fbJ;1O5SdZMWv3Tr
zYpw^7?XuSc$hPJZR1Mn~^T|Z=63y988tCMI@ySF&A?htZnJB<g3yD#70x%abXrWyI
z3bDEVzyD;S&UxT(@so*a{ldP-F)x?>WWs0oEqyXk%@F&`geH7c1!V4F`_<+iwvX`c
zVf%!ld)PiIzK30f3;AEMDwvvk*glWs9yV_32T04~=iB-d3f%iHRCGxpu;61s8(5G8
zzeHe3#z$Yrj4=btwVblo*6l$d2`tQ=b0K?O6j*E{*iS+snzGj+uf7kt^nFQSxgK-)
zfIo+Cz>7D6!;M}**iXm>gaZbO1Hz3A2sfs11Ip&!lK^$S9Q5cg{SHSF1t?_YOD6AL
zBlSLgNDk?nB+xfk=rYiUA?IOF6E_2jR^m6gVx$$;Xf&?X%Dy<rw8lXOcUH|6<i?8T
z`TS$NIiZ5#Ab&yefADQOy0kbwb!uk*<fgsmzgw0kw{F?Q|L?a`jxU@#Ju^48G_x=-
z(~FA>i?VcPaen%4Sz3_AGxJL`r>5n^)XdzO#p$N~_IGUPmc!Q_-YGNqcbU_trstRB
Z)YSZ$sX4*F(_C1*kI>XfQ!%tI_#c8&M}`0Z

literal 21136
zcmds92bf$(k$ycptDW7M-JQ)@TeZrTR<eR6S+Zq4$&xL}wq)dt?e$1n$vYdg-dV}W
z*jhPb8yn}q5lt`{1jhkBIKl~zbc6$rbZ}&jbVLIthx@Dhy?#A2Z)M@{yYQVq>%Fe(
zepS`o6}qc?*2@(}mFIctD>oiF;_+4LusV!KVruFtHKmU8sF<26uCD~*u%Ln(kN_Z9
zU6`S(1r?R-CxXI%s5D=>Pc4Q)6j9dra*Ret^g{lLAKr}q)mClGP2@%gM=C}KM-yH)
zeKESf^T7D{{)x$Er#!H0aB~01;K~)A=QinzYcepN+dVwE$5U?0B4W9bp?zZmAeL~O
zG`hq_b0Z`BcY76XgCZJ6pykWFq}wFx(wLmcjeC`Dbqs~2E4>+RlOC7C?yCoP4-f1*
zuy^m^#6V%_x<RkXZQJCw#Q<J6II-VLb)KEuJu<LmbbMrB!$@v;aM{4d{bPm6+}LEH
zPgk9tD_k8^?HU*u*f%%{+WSUx7vy%040_ea`JSiye(0e7cwnbj6V7POp4?<^0DLDV
zE2g}PM~+~+Thp1^y83KGV^ecWYg>CqXIFR6%wC#tyHu(v&%Y~?uKKMgMz*z-RbgOg
zY-rNU%q*`sFb-aW1EU8<CWpNGo@pD5<O-8sc2Rk~neBmVhbFIv_CO&E1G%w11H*%d
zyymh#7Y5ws(x#<-I+9-N!t$z#!2*U{GsD-KlVR$$)3deqI@+db;&sMIVMfO5imBQ&
zv~Li@(H%3;dnX15y`Gqg-TTK6c{6*<CAeBtD(sQh8`J5c7Ezyb1&^wYra-+bRLw6R
zy%Boyinl-q5{bhPB&K|CzUOhZpXC~=$yRl0*w6ZE#7~ZBAfHY69#?USswlM*jnkC&
zJrt<MSHoOWu^t6)TXMZ_O=&>MkvyeAH)>QwA)_i)8dNv~bS=KG^|M>T?=xISNnpSo
zGN_R}*HgX7n58T?Py;toovzMPqtLJQRi0~O==(`-q9)s=<ng-HOwFcCP12<%h}7hC
zsTq)TsX6G9X%xefnz@A%$ti!T()ZHbiY9H;LKRPlpm_Uq^hGEqQEpx7rSNK7>19Z9
zJ9*rJIp_puOo1KD4nS&HGjF%WKnkg0G<K#Y7+BBGn9k<83-#R~+U+Op2zPN0bqQu9
z4^j{!EEaes^%#g|ipbqEw%su-fa(R+UcbgtMS0xMjxeDcOl-&fxT@4geP-NQI>R8z
zPVf5w$+-6gJvNPE#GyW(MYDJ|&GLh3&hs1qsc;zP0<dE;&;Qw<o_gknY&FlP`9!{#
z4~Bvl*qW2*B-AKdv(VNoqD81l*qVM@vzQj6roz@Nu{9^t$*4)%nx(d887)IirL9?R
zYgW(-)XcCor`Vd6v=TK{wq}*BSxu`^ld?6Z+L|@A1~t{TX05F`jZQ;NjjcJ|)~us-
zs7c$JGi=RzT92BHt?_Nm2HJp{T3fTx)|^RaqNdK)Y_c_*X)|i-ZOvJfq5g16&IYhF
z1hxP;B?Pw8Y=8>_P}Frcoh`;So3@B?&8DqlTp3ytez6U}@(?%&z^V{9m*xOm=+K%&
z+l1B}I!9>Dp>qwb)59;$Lwi32wgcD{0y}6fz*8MsbLl*xHJ7#vt+}+r&^jah;(WB<
z7y{1&a8?NHq<H|>I<)4|`9f<RJx^%Oqn$!)7GL11{)MjUU*xL(#lFXv_=+#}6MUIp
z!Otg;E&=t>PA&(0sRLhu_E*9xuXNnU<vc)_3&yyQD{L{(SJ8lh=qj0yE5&_W2@+B8
zFdho19H{1ssO|z)U<}m@Y%$NfX_tX$w@}Rq)m#i!$o_ms_C0{zz767&z2Lgn;kt+S
z(H_AVu7kE%;Hzn$f#_=Cx>vaFjpMq9hk(w5GBnt_!yz7~A;D<MJVGOW_Mki_CwP>G
zO%06->AaB6$C38vGN(ghB^}(4PsYJ^++jP$*U*??Oo#T{VxA}H8UxXUa2*$}<MCWw
z6)1qKE5#%}IRLH)9IgdENCm+du9LP{;A`oif#_P{dO)}yh~rw|7XW<-ln*(SU%=PV
z3j||^@rCq4KXVX|W(?!?be*Z8>xJ|oA$=&0bg>@XfDXAGJd97Kz;?=EdjlU)bc3Kw
zj}F^no^MoyN?k=aD&agOoUxLM)AO4YNZ+K2Xx}Wf1!ss~7?tyUiy~B;O1edp2LSqb
zmNP(CT$R670paTWZSv9WBEs#i2)8PJks`DftP$ci2Pp6ziqOE+(j8g~0FVOD7%4#S
zPN}#{INjxPx>NCs72T;c*39AEitbi^>YzN^F^%^qLKFE4q5dAt3jlcG8N;hs8($(l
zc8B0z`RG28<33l8mngnp5n2n@^!Q!}$nyh=(7@Ev16m3IkOI$GDO?qLP^55;<RSU!
zVUgltSBeJ}KcWb&1#6^u$N>ucs3J5lwe+Z#0sy4IGe!!~drT@`Dx6;Ga(Ybh-za)a
zX{;IdmnnLg@~aNYvjgM)az$t&Ut!!|u6Y3fFFa#-dC}7973glXwtA&Nc5(G8MXyl&
zYDKSB^SvZLZVD-WjVWaKwWi?l>!d)BYsM(N28E<xUW-CX3a>*UL$6f)dPT1XwG=;L
z3K@QbDR}%wQ%LfYQlKX^H5A^UsiE*jO$~)7HMLhMev_g%fm(*&YziJ9HH9R<#S~Kf
zRw>Y%H8m8DYHBFFMN>oJtwIgM^tTu>ew#u#{X2zt`gTzS;G&574#A*7gn6e7?^7~k
zPq{Pp4#j`32+aj+bmN^4kmq+PLIYDv@6w_Hz<l9ZK3_n+TX?*?gvUQ<9)dMIF48S@
zInVD=gnCm+@6jv(fCZlAEYPvH3!QNB@ZPe{zfV4UzliaESB&>6{zpY<E?6VR`y8Oa
z#}uJ~sik9D4gin?&lovC?*mftLE-d4m(vFn|C6E*D2>&e_(O_5q$C#06K3#XMQ9>l
z!3;jEc>w?~JY#rygo%#&{1NGM(I|XWKKqzR@-bJEk0}0UMQAQq)8~&mK%PIY2n|dv
zeO$`{0CM0ND@T!1eM00YlI)Z6*{4K~Pq}h@Lh-*SLUX|yIX>wC1^%=mG%&UFX)Ol;
z$bn~!9H93ZsramL`mD?8Gm8IJ(Pxy#nz8?!qR%M_;CM;||GXkJk*_fJpVzzqfES)I
zyh=>#3)1Je$;Y7veo;RAl1TC;SCTI%{x?NvE?Cp&FFHV;zpMxiOf7v`%K-p#;8`vQ
zP+t)qUn$}7@0y2T4Uda;3ti6hR~4b&RMJ;93jkn&XE}>frTUt5waBl0T|WDUi17_q
zjISyFrXn;KtP$hu4p884DMABNOW)FR0Dv5L#>fGB-<FE+2&eD3oW8C2KNNjiX{_eN
z-&OQo9og}e$o@S=Xd+)>dcUW60RS&NV|bM)@b{(9MW*!w`Rs=x$q!vgzOVQ{6`{Fc
zO`m_@0D1nAA~Z0y^dl_?0LX!7tQ<v3^<$Bv$h3YUpZ!$i_^B($j}`w+5t<9u$ng^g
zDDck}p@FHTpKCb)Kn^@(<N&>=rQ#RD=@%}irxpKF(bGy}&Dj4+(XVuL$5W#FGm6ke
zzQWi)qj>=UFFa#-Inn*s=x-F=e<P5M?!Q&^YsJ4)^gA6ve{TvN|G^ZJ{6|wr@t>qX
zzt@aW_yY<_!Tb@0lobAiLWX{$_|J;|tfTv1Od-QZ5*p+2ji!*~o1{R0(bP~lk`QVr
z+=xO-3OAvUq2DULIYBokWaV*-DWv#TQ^@dbrho;p6zCRw;z{9FO$~+HG&K}%*VKAt
zxO(G83(MyOVQ53Yb4LRCyF2lSP<IJr^G`1p$d2OO2@t&}fmyvL;cN_El;D>n2$ThD
z^anI8P~dwLga!sd_iFJ0KuA2x=M<>>gvWg)Jnq*#1Z#LeHVYK^fdrv}LC^!52LSNE
zGnU7L!s9`g#~lfNC_xw#!5SVI4GR?b;RK<9LD0jR2LSNEGnU6A!sC$=9*=4sf;Bwu
zPUt2YDDYzmLIYDvk7*tNzyr@X9#ma~PTzFr5uGAm7i7q*{1h_aDVx^RQ;P((q|Z%;
zypm^7CCz|RakWre<9UQu!<>TfDJQL2EofL}b-(8{0{e(UkjSm(8n8vC{KVKI*=5+K
zg>4#ak*K%1<P0ETn+e#OMsaL2l21p!eDNNBYMM^gQJqiH$vR=G@KS5Mgn3m6Qf#zt
zgSQG6s+(lZs{#4@nw4I&r14kcOs0<O(Me?Yi#rL<v15xP0FyFCVtJUe=w#OEWCI}R
z12sT=F>li-u9I?*;NgV8vDs$VWLsQ|Z4Hu@HOS|;fi$;UL<e<<yXmxuF6xrKO1DMy
zP>*akW?Doq_0IRQOcue!^Klf`XA!e#)_kv>XIsP^nls<)=DEn$w@bfTs8fa)xqESd
zEt0O!P%DwtwNjtdwbE><Yo)nnt1=HmHP27j3{_*~tmad_@A=41K|de}nql;V)0YLb
zKst<sI4`7yya*|Csm{|P;WbZ8YF^Cv0@V+O{Y4CC2vK~?i;Ebx>vV6(a0x9DhRB)o
zQd-K(kX6^&U|J>&`-NeD3`1(9g#Q<H4g4~mernQT(eEX&)-OU-V1-gB6oh1>Q-P_J
zv2#%iycEuCQl&V3mg9Wc?`2DQG-w_&GmX-t<?>4M3VEgY6nSNMrM$AdN?y&pT3+pZ
zs=T^+4Ykwq0<Wb`T2bKBsGCkH@aZ&@Ru&kkd0JKAGpLVN7kE9g-KQ4VM{;>hfj3YS
zt(BfN(P`3~COTa@&_wG*mS#Fb>Y8c2)HRbYb<MOvYY9~q4Q=`<oE^(a;mW`b&VZ>_
zQPpuwHOZBfq)M<5e`!p$N=&s1>HzB2AK^Sv>ro10BLbO5U>{Kk++Ye0)x-IuW2$M_
zR5Pxr)>@l^gOXvdw+Q$cnSch1Xq0hIag#;h98e~u#Ufg%Ri>xSBHF24CaS|CI;m5p
ztji+0saqzmhcZ+z{mM{-40MK?WS}$DB9l-nCx1A+qz<X8r7o$fr5-&AJQG7T)3KcD
z$W(iw->#|7bW9a0AsuF7#=#nn#CkzROm&v<nkkkuGiH2&nhl1tix^r{om0fH9nB)&
zFqh^E!+A81ag@dja84rCd0HS0XA8sGF$}5Np^0cz1YrX)S%lE08+E$hb4=GI6qv4y
z3Qe~JXH3^6sZG~KM5bFUJv@o<O2Pr+mEuM6%5cBDvhZbiHS-dAwZm=U)eX;8PbU?4
z88y(t0xyT{Eh_K|IO_faEWeEw7hw4vw4?yb@1m0nu>2lcT7c!(7(Z7-%SAJ4XoYA-
z4V@xdlctq2uxVN)b!l2Hb!j@)nC^_Cp-#W_CYWwAakyei9i9=GZ?%8SJBmfcF@1_}
zt@s#1y>|Ff#Ep(@_&F{sA_{>SV_88JINh(siGHFia@Xrv4LR~y7)aQbVz5-PQM`<1
z()Tter$|&tVU%jK=}HZF21s|}egJxx%%(~gcz=*fF&LgChDQa%gL@2S*+i8#OjZyU
zN_h|&IeI;Y0>dulFj&=+Lf8=_2kTDVl(FbyaamxA*$Pj*<dTGgPCq2mQ;|4a1OC2@
z`w2};MEAK)OGLq$78$gpjJOOsrU+{?OjDNNEa4fj;Idvj3&_k3G(0Q@(<C6gtJ}?h
zM+JEpy+%D)3XxO~mYtcBk@=0x3}Q}IsI+kJ$GkBe0FHU%=KjfMed**H%)Q(~siYd*
zCc*G~7LQLVDV>JSK{+Tv6_~nAw!YJXwUo?eOSR&=!W*+9Mib4-QSihpZ!?-^h-K?K
zNwm)>U{aG!Q)RZH(nJC%qDK1OQNhZ!7<XXOPY028j*YA^${@6c_L!|OF;rIB)5cJ-
zm{c$W$Bm)5m=WCZfj!AO4CJ5VU7oTKEq8gc80%W`DG_<uBk16cTROwRRi8+g!h1Xt
zrp2$BMi{0t^0G$|8^MkwQL-b6+R7dRs)B8|R^!lj6rr$1QD~JB$C;J*oFTbYRP+_}
zw9)s@l4T^W@<5H`E)VVl8UCd^B8NZj5OE9arNz0<1YDk4upxn5SuGc!K(rPKkS%fj
zZ5G#&#j337=qhZHnsJpV*o$G#+VDj?*tGj(y%cbHYR?m{90lumKmnU}VbdPRrj0vv
zs5Jv7J_xHBOQGLW+*JhQE>SoPP@tlXp)(BF?@*VhEbbD?aQEO^5!M~iw6Iykgj|zM
z)N3uN8s)$bF$SM{hq0Jpo(1`3mC`3>xL!*^vj7FYXtwYZh|!>2e~9N$HFi(EY<58r
zjk&Ug(Xj@Lm#`QNoPaEwo2YZ4HxG>*<Hhrx$<-+z?4go0KU>?02wxJEpOkCI@NKEk
z>Ip`F0%MA$G(12!x0o5}Z!t=5!r|RdfEwHYX^X2NrB@m71J%efG?j{b+bu@irchj;
zPFUPfL{R||D;0X5AaxRYAL+@oHwneLrGx1(jbf&Q#QUT|?-P;N-bct!>wScLT|oYX
zyw7p0U%U?n->SLpe=$l=5xk@1N%X4%FHA&|vL;UgXbtRMzmUohKh=yE{8YR6DaQ%G
zLk0H~yR8!dE>BIy*O<*bprCiSvzQkrR;J6;$k_FemzBGVa5S^v3-j4ZuT&Kt52A8K
zpbGGczL#wwyt#st5?|rN)8D++XiRUYF{0p(>dK1Q=&c^gJeXmrB;#hhqd1+KA{a}u
z6HsZn=#`ea&QOhLoGdnFK_5C9PgXU6&A14c`XU(jOHY6cl224GTrfGpMUqGubvx&h
zP;$8@F}4`=V3B|=c<9<%#I-dIb1Su2e-7VmU0WMGdEl1Xg`YtBK53~d!jyHuygI3g
zyWk#i-_z3Q1QgKdu*E<fq()y3Ev4rp-0AC)Sk2aPw=)xwYwH%*h7_UGZTS4MkO`mv
ztRb@(+Cz{Vw??fR1D7X4eiR&nkV&B$lc+Jpsd2AdPR`1fSBK1AX0+<l5hDtdqTAG$
zC)9;uvM(f!=#h_&9)6iEyg%^bHGz^>=><fj&^qzqC^Ys0wlA0ftn`DCDUG6023S^R
zqRFz`s}@z$x24T^9_K5pz{I6XW&t^GWEP<I$k1ln!~~rLbNcbXPFo^7g@{oXjLk+i
zX>2xx<;M6lU5FG){JqF7d$E*sp$3+ml6{Nacm}>&(=u6f=X3PMq_Z=ktQkxt(%V+M
zYXOP-t_?KWG>X#<i~-o<7Ws*>4cxCs^}@CuY_ayVY~hSG+ibwrG>T&@{`%Ps0RBU^
zE!LED)F?*jsL^PmhJICu&ym?}G*JVPL=F9F0KGbi8jX^6YKM3K>sGE&GznL(_&&6i
z6Ir>6mx@<YXKIl}mmBaNUU~u2CO6=z9co&#UMh<^Vrkiq(x`Le{fIivW-~7v`YQaZ
z#y|Wz>hP=*IE+j%TC=+fdba@Cn`%lN-7rPfH(Z33e?=u+5b`BAZSc;g>J8pS!FC|P
zK9PokC&Z7}44*4IL$jH3Y)EfN1L_j@YV}N;2qfGjB8BvEP-5vDEa+nsuGLL64!awL
zok|uFCsFnbg+_@iW)<6Di$+7Cni7Mc$`bt}2NSMj5%ufP>+7R=D_!G6-`G&q?zro4
z>jC2o-F5laBcc&x1lr{ACo5`z4GskBpf>$u1{1_eJa$*!*@jS8=&=#R%r6{Dse@i{
z{DQ=Q*`Rw!$Rb2JvxDC{Sk0E%>2+Y49U`)`L(c3NEM|u#j0B;bh>zZYjf(7Z^bR$T
zYxu~(&H@}QLF5Mt5uD^XzT&x}L9?;>=tJz9o2|!&L&x7R3}btdIBErfdPaH@;33Ka
z<RlghqtzJWpa$;|UI^5}VO|8S=_f@C!<EP45*cya;>aZDE-suzCUc>tyNnjn$+Q%s
z(of4E=5lPNR?uQ(Ggly$xrkR)tfy6uqg)9nP{~tl(W>NXjbeNdr;?|JF620>xCWoD
z1<$pPDgu|MwRzpcVCAqjRF<`(ENf%<;g=D;qKa$KHQ0es$J1yHpN_`sz+s)U&(;fw
zb$LQv=oHt59M%bkbuk=(3Vu6LiJ^qM;PsdlAG5MPoRtl59~)^Ss74|9Obr`%Aqu+5
zfki>_y9tmp?rF2576uEgIEyynrv$-f`fT!f3!TkdX+3X4ueLdJwG~h>S6gh+&eb^@
z#rPm@uFj>+v>xu`yc3wS?I5uOymvTr23($Y<mpWGJ(#l{;fU^#5#15Pm$uU;nX~P5
zo|&)nX*)j;4R?b2&eHkXnJ3hR^R+XizEi00jG+$H1(=Tu>B6G<xJbj%d|d3nG9Q=V
z>UB6DmpJobu$Yfaaqm2I7?;qca2S`-MPLy*jOXJnbL1dAzPt!d@)d9xSBef@PFK)n
zbTM5COB^V17+1ma*AF{BLm)?<s1`EibYsdH=dp`+f%*u3av_aq_b~6F4Lpb+_3RGy
zXm5$g`)FU0$oSoa11EV1pNe0~({8#NKZ&@61}P7zhv{PcDq=5w3^BrEw1@X&=Jq=}
zIR+@u$x&OhIytUUj1S^;@|qLS#R+^`0MCM>i@@cnkk>s7bg>X>OF^`y5W|lq=wi{u
z33N>lZQw#CX+r<f;UJhCELF*adHfW@s^r0t$w6UqFop?G*9QBtwER#a&4=hv>6-pY
zxwDc=98P1!Qy;8)8vbY3_b?lMT;#YhS*V9S6*pGrz+yI7m|L@{chuBip`y4qf~B-9
zd>ZWvK1ea^c`n;H;AfvE>x|X%FgIfS8y&@J0wiaYO<1MM64W%p07vW7V2#qm&0yO?
zEhoknXT^ps^18!8A~@POV5hIy;yhWiHI3rfwlbDfW(j?qWH%0?i#86}0$>GQgu-4z
z0o5$Y?soH2({?PhWan<Q+ivNRKj?_TBKwOJ0DdouVK8UXQGa?6WnrH(lHIl#^i67F
zkD762l!e>tMTQF}IdF!O>e?2rt2HvsB-s@rS<d4BJl0ta+^6M>9ObjGtURo&%)+V{
zODim_Is@kON=V`48eNYTX$y+rBo<UzT0ke^w{}_ltTpS7l%$as`h-Q+BC8@~#E#d@
ze%xQt6SYW2Xc07X5&9qIv-<(bmbTxxIf2k9PDT20>b#hj&|-7eBBOM2><liA!}|8(
z;xZ6l4k_@fNSl6HB9M%{mSw4i<cGpyE6c?{Esv21s1=~I!l84rK$gxj4TW@82%Qx%
zbo7Gq6f7teucC##8Z=isBeV)o5ENG0VlY}#!)RP?$BTW^C%`3p%V&a&W|)hwg!7sq
z8_-~-AkL~v!_k_|&Fn<h<K}llEV4XErQW4<F0~{{`f)k?!`br;IO(3iK}XypZiaib
z;z&8tiR-M^iB)6ECUJ@^kIg$BCvjR~6Sm^6OB1KCP1&1@N+0u#A|P2Wep>4;F8U2~
z9cBjkRI9s^O%>g(4`#zO!fZsW0<T&Rhn_M!Sz*)!LU7lX&~di1Xa~+{Tt?K-N)lTH
z4gv$@h2J*rxLLkx1{-8FEF0vyweM;PG}|<aA&mrWE65{bQA{5G*N|@$@@*gwuWiZ0
z-D>i<ETj#`G>Rh+k35~XkA@EZxg_H%-o6;6y?v+o!vb(pa<tjWU5<u?nwb=zZuKO>
z;<!%!006E$<8C7QLr#Bs0R`TErY#12lNv^2j^quK3uqCZSvU?cYUd<rqx>&+)jCNV
z$%vF~pjLh2IQn9E5mQ!HVNBI>Vk!rQ(TVA7d@u(+n&T|PfXmYy+>P=>dj}M7!M+@S
zKp>9GY#buaEzLf?JIJNB2Butt0dz0zmM>PKOBiOkB)&B*!<dGYNC#Ryk`$7J*i10i
zrV%8IC<JCDmv&`wrOj3^ACAjbTeGm8)|!Q_{NatLQ5;*b=33l)R@qD^0;Ck>EGUs}
z?DPp%-f*1281=y%qliwMJ0uu|24@tI%hb-LF_@p}FPb3TiIWgXc<J6tU~HjU9JAmL
ziijser(|^%oS#QQuNl@H1*=vKg~7_6pGWeB`pq4Xw8IH{Edtq~*QTM6PKRg}jJ<sB
zn#8_gt4LcR@b!QuQd3q3x&Z}2ugeyLk&qfJ&*EsBpodApP~iTPI161Uy@>M77b6(q
zNP0`4z5i=}3&!3bnMQk~%U?QksugqElU>o?vU?>Fg}`V|<nDR&k*Krr`B1LE;_i7w
zAz&-Vh8bvTCQ`~~0QxjUG_(akCREq|_jk`LtOtIMch5`57v|6p8=Cg+xy$f5-90a5
zh{KkMCM>fE(id9YYJH*AMK~8)T|&WyRu>gsXf46{@^^)bnCc6yE|2I!E3Q0a(Jwcj
z|4-jV$8IfC)Fp+$f?r*kz=B-qaRN&;Ka4*+V^*yj#bh^Dtf!5B<XR=gDy!Br19xf~
zL4P6&fythU^y?<1TsK951%Ic8@#kqG8{UEsw}Qh~Cm?JV$OeS7H53Mftr8Hn#&845
zq-di6brx-N=t!0pjv|Q8NZ#gkdbUjJO?(cW!{?I6=M{~m$J-(2c4s8c0~7?Ab8Rsg
z6{%q~E+3UmVUVd0gAA?##@)6}-!Io)l{d>v-<6O*aJG2o<iucZbZBhf;tl%G=oJQ*
zFI!ylr{C7l?){_VLnFD#q5WetI5Dw*f+i14j1BIg$^A5OU~F<|6o0cNH#Bl!Vz6ej
zdC%{=VEdWd*U%9DMBm`(;MgRM=Ee@>MhJhxZ~w$0fpYtFMc)E%dQs%BwEg$<|1aiq
B*0KNq

diff --git a/src/wasm/Hacl_Hash_Blake2s_Simd128.wasm b/src/wasm/Hacl_Hash_Blake2s_Simd128.wasm
index b1a26f75e6b90a9bd26ab9ade9ca6c22708f4a85..64e5c9a79e954f01a2c4d73f2a32b9440113175c 100644
GIT binary patch
delta 2511
zcma)7TZ>y&6yE3LBsrIy<Xn<W=Dv0^9j9Q$4mQ))V!KDDoid}NovB(y!qAH}y-hDD
zh)kxfii!&3E?ATbeGozDLmdQ_ib9_SEm-i?{sDbZ5i0ualaoxQQWZkZUi-Gz`o3?i
zePib0T#n73KBh6ov>(qdEiqcoZPZhZWig_s8_V_b@@K*FrFB=YNp0%l64tvc+sU}u
zoaYB&zEJEcb@%l4^$!fDF00j4gNbjLgMVuOnQ9dMU9+9^&DXH4DCdn{`M&;CW8I{9
zc)B(zW+!Xo(_(63bhb9T`_V@>j&6oM^YBz{eBa!}Y(lHtec#O9xp<fUFT18D_Qksr
zL#ub~y3^^bm~P!>jI8dvbKBz+duC@I6VvgP$(3L9x@H_ce&~d(8U3k4rw$%ueMpk@
z{(IzQy+>X$viiViJaoru^T!X=7UoaQA3MzktpoFC=4+=9zjQE>vcLaIf&77@Lf02l
z4Z%hj<F@d)LypWOdwr8zWRg|IbcQm5RVBCkEaPaMGT2&`J8jBWm|%4;$;cLr#|KuH
zlb`6?hjN?wb53A|T+d1pBTX<lW>vI5<+Ikb{K(qW^WHglPw0zwLtAY6cfhLhCZ99=
z(iXSLB3r&2KG=xI2qvQ?HOC>BXDNkSlShPh6u&ypQI30*<vt~Okk~<iU{l79=w9++
zX=-Pky!LPdV_O-EOpeX`A3h9XS6=2JX*8@0jS>`6*0XvjiztQRndGcF<@_OkwfF0S
ztvv1cTH$Jptr=sRCO{-l29^6Qq-6?dHwt_M(^MF1rx2NjDXi#Z$rHi)`xtU3hx95l
z$N@$+WjvqKh#<*Rl%y2aoo`=h@)=0(?g0AgIA{?jptR*eI4oau_sTP2S>AMS$a1zU
zKh4fqV2ODFFOYnrP?no=Me7|^J<tW0bGa=QT@itJy;i)?NT&_TkXK1A<eg_+aw((o
zami6RxMZs!6kQO2FrzD!)Ie7!1fZ_dW}vath0cSPi$(|@Jmn%JU%3b=P%c8Ar+nK5
z$VEb(E)8C!f?zxGGa68Kp(UIy&`E_OyhL5R8+i6WJf#ltbi<0p(*w8Z$mAs{^7(B=
z-V1>HsKEPis=wn@AFTLPZ+jR^POb2MTo6jf&+N$YfsSN_sdPF5ng={biLHg2N@<V=
z1=}V5(oPx;gq;-3;Usys!Z{)@BZji@cDH1YxjL2W&CBI){>UV8GONtPhpvpV5^-L^
zxgnez64XAYs+xxCgtb_tu;SQ<gjVN6QS1XjVEquQ+>u*?bp>7Z3>;cjicO|`n}+4r
zfg`Wyd`Mq$mEo?cgwZTP7E0LJrm(Y+1*4o-xKr3)yxJ6GQQnT+m}*0Z8;jC%e=w{h
zC@%zlj!fkSbpq)_l9BXpy3;a|4&`E4dcY@NRR<$aQQ;wfuY)^ZO`})%an8+6itvOF
zAp-9GN`z>Nv7qA`UON@la44c0jy`B0XrmxD9A{(9RMu8-5q*5zm#eb8Qgao=K+Vce
z6^i9WgjW=OZF(?Qr(!))d$WhYibE|bdWun~1>V)FnXVE+-3sWE!rPz{?*`D_E3X%}
zTh@8ihYfu(BflG14-WqW+(T_}i79Y_f^if;)DafST-nX2MwkaaSMBwzgfjP_+bieB
z*%RcAvnOL6$Fm<hsQVncvB6Oqxo+!LEHC^2@%~UdG{EKpHdiFtu%Q{$$;I>4rVUmM
zo2y`RTdJ0y4<4xel#E_Blo(HN1Kr<H9d_w_6RQ;7tc=`FyQA*7R*cRXamL+o>*^&6
zw7WD(V52&tm+rx+*`U0H%;Y!kSv?-VfF7VSc|bl7)u}wPMf+<%c_FO0{{-z}oUK}c
zz7}{fRlpN|D<$9J_v*i=<(K$eu;kff-gU0OiA*(CVa_#s#VS9quiPH0>2jj-!r$DW
B*Af5#

delta 2136
zcmZ`)U5Fc16ux&dnaod;xs#bm(#>}F+)cMlZ7XzJQ*8^~yV6Qgse-gmb`9HAJDbw#
zRz#6atx5$cxLo|91(Cj33Jc02LLZ8c76psG_#o)3Alf${D%5i(v)QaD1ai;)IX~a`
zoiiUl^TRQpbr#QX#u&fz=7kGveA(a4^UE_WZY_5wxUu~HLtlJ*nOh%Sz{9FOX;fqD
z60LcUsoS1cxcfF5VoV=0NAxY@1mBA*Sp7S9loy_Vd48TX(xbxM*>kV4(QWCq>-jR@
ztUG2yU(c8HFL}4uS!83*sm}S%?BeOy=X2bB_a=qAN*Ni(lGRhJ#h7%IkS@5QFp}Cz
zDBe|OH#HJrC?*Tih631ayzGIe7%sq7d_lUoX<V?!&FS<ucxaj31U&TH-aELp!9|hh
zxrc6KvB?xmM4o}Oeqr^hb;ICS^bzMSI)jpM^1y)W!)}w`)2H1h^jGel;Dd`;Le5xn
zdweO4tWP?V1zS2`gQJfX4(LTIdJ^cVxj^OcZX(N2mOhlE08<8-crcW>K#SAO1pL8r
z7i0Ue20D>}K4(P_=76odAuGVaP#h|h-UyV`*G!qhCM0B*10v-8r3=Nm)owB1@r?{}
zJA>Q;1XTw?bBB!?7Zg*F=D3S-inwtLli+}U>HZWF1%3R1x0wkpGU9+I0<bW;Df3`L
zo}ynO1tH6!K3JZPkz{*~WV;WD$m!3^$DMU+oByN3iFmt<XASX`4@^{K43VrNRo|I<
zw-f0TwLpI;s?M+P^!<<PFU2DvN9V|*5?L826iQd`iGnFv0**&^dPIUlB8DqQQig3N
z1wHKr5P+ZJ4}uT~5ckT!4{{^J4Sr1-L8#af{Fyz3FkIt3Mt&e%kX49f4MD0S_thcp
zYiMQM*C`%ZvZ@0oIvB}Ki2MkIvVo5pLytz#${uYREHlB-iEN;QP+zGOr^|A52pdI!
zCoQCIRCpwwHDsuw&9GUq$JBlPlG($o^NM+LOn*|S>*vZ|dmNJo%mb7-y4G>HmjEO~
z0np0w0L2ptRLImgb+3SN7+cxL>M$-P`kFvr6AA{ts2yP<0X$Qn9|&7|C9F8NGVQwh
zn{YDEsmJv9a;v^y@=Gq^g#sjgJnaV~xa&=o02!wlQ38WBT0+JdltoNRmw9PnV_Kxq
zYng^(y$qA6p}y|dHIzzz6G<K;;K%`+0-@wl%ta{bUGY}E!`r7LCvY$b?)u=TyEmKZ
zZcbq1X7J6Sd}w%OLd;ri<5t>g6@^V`pw{p&N0Or&Dl=>!v&q_zIHrFA`YX3tgnvOB
zL9NJeEmk|iLSuwCR-*%WaW8>5A(3Y7j#frhOjN~0RSvt2^k1t13X@Q*^*g;L>xg1~
z^>FQw<NQvfn8uQ)FT?i#L$3E9$l>5Y<S>J@&l5}u+mr160BSLTWUbrVS)DLNEv{Ug
zVNZiU!;WX#%yvKXaG;iDpiEi8De+T2o#^Q>(gz$@pPx9@{KHB&QO+_aO~`>s?EgkX
z9BZ&}h<p0p#L;w$&@fzA08Np)?lnD{Bt1!^mc|Ett8nP1gI(m(4AW6vrp_xP?l@2e
zA0-+u>0r;W?qAxFOZH9ju@qYdAY_FCh3E*$8aUER^+pqSFa~Z9mC}EX2t<g$p9MX;
zWvB6$qc3mS+5FV~_ZN;z_wKxhwR6^F-feI7=PfT7<ujdb_w3y4tEbPuIJ+>fpKU#?
Tqt=ntN4L!yMrTo<Y`yXiu?u@%

diff --git a/src/wasm/INFO.txt b/src/wasm/INFO.txt
index e7adb2e4..90facd82 100644
--- a/src/wasm/INFO.txt
+++ b/src/wasm/INFO.txt
@@ -1,4 +1,4 @@
 This code was generated with the following toolchain.
-F* version: 96f90842af8c0137bdee87ccb7bd3ea92485efb6
-Karamel version: 1282f04f16a4e193f329708b22e0a4577d5dd092
+F* version: 32418395d1c3ddb3beb78574b966b28e048b5377
+Karamel version: 7862fdc3899b718d39ec98568f78ec40592a622a
 Vale version: 0.3.19
diff --git a/src/wasm/layouts.json b/src/wasm/layouts.json
index c7e414d8..d5f5b2dc 100644
--- a/src/wasm/layouts.json
+++ b/src/wasm/layouts.json
@@ -1 +1 @@
-{"Spec_Hash_Definitions_hash_alg":["LEnum"],"Prims_string":["LBuiltin",["I32"],["A32"]],"Prims_int":["LBuiltin",["I32"],["A32"]],"K___uint32_t_uint32_t":["LFlat",{"size":8,"fields":[["fst",[0,["Int",["A32"]]]],["snd",[4,["Int",["A32"]]]]]}],"__bool_bool_bool_bool":["LFlat",{"size":4,"fields":[["fst",[0,["Int",["A8"]]]],["snd",[1,["Int",["A8"]]]],["thd",[2,["Int",["A8"]]]],["f3",[3,["Int",["A8"]]]]]}],"__bool_bool":["LFlat",{"size":2,"fields":[["fst",[0,["Int",["A8"]]]],["snd",[1,["Int",["A8"]]]]]}],"K____uint64_t___uint64_t_":["LFlat",{"size":8,"fields":[["fst",[0,["Pointer",["Int",["A64"]]]]],["snd",[4,["Pointer",["Int",["A64"]]]]]]}],"K____uint32_t___uint32_t_":["LFlat",{"size":8,"fields":[["fst",[0,["Pointer",["Int",["A32"]]]]],["snd",[4,["Pointer",["Int",["A32"]]]]]]}],"K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_":["LFlat",{"size":8,"fields":[["fst",[0,["Pointer",["Unknown"]]]],["snd",[4,["Pointer",["Unknown"]]]]]}],"K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_":["LFlat",{"size":8,"fields":[["fst",[0,["Pointer",["Unknown"]]]],["snd",[4,["Pointer",["Unknown"]]]]]}],"K____Hacl_Impl_Blake2_Core_blake2_params___uint8_t_":["LFlat",{"size":8,"fields":[["fst",[0,["Pointer",["Layout","Hacl_Hash_Blake2b_blake2_params"]]]],["snd",[4,["Pointer",["Int",["A8"]]]]]]}],"Hacl_Streaming_Types_error_code":["LEnum"],"Hacl_MAC_Poly1305_state_t":["LFlat",{"size":20,"fields":[["block_state",[0,["Pointer",["Int",["A64"]]]]],["buf",[4,["Pointer",["Int",["A8"]]]]],["total_len",[8,["Int",["A64"]]]],["p_key",[16,["Pointer",["Int",["A8"]]]]]]}],"Hacl_Streaming_MD_state_64":["LFlat",{"size":16,"fields":[["block_state",[0,["Pointer",["Int",["A64"]]]]],["buf",[4,["Pointer",["Int",["A8"]]]]],["total_len",[8,["Int",["A64"]]]]]}],"Hacl_Streaming_MD_state_32":["LFlat",{"size":16,"fields":[["block_state",[0,["Pointer",["Int",["A32"]]]]],["buf",[4,["Pointer",["Int",["A8"]]]]],["total_len",[8,["Int",["A64"]]]]]}],"Hacl_Hash_SHA3_state_t":["LFlat",{"size":24,"fields":[["block_state",[0,["Layout","Hacl_Hash_SHA3_hash_buf"]]],["buf",[8,["Pointer",["Int",["A8"]]]]],["total_len",[16,["Int",["A64"]]]]]}],"hash_buf2":["LFlat",{"size":16,"fields":[["fst",[0,["Layout","Hacl_Hash_SHA3_hash_buf"]]],["snd",[8,["Layout","Hacl_Hash_SHA3_hash_buf"]]]]}],"Hacl_Hash_SHA3_hash_buf":["LFlat",{"size":8,"fields":[["fst",[0,["Int",["A32"]]]],["snd",[4,["Pointer",["Int",["A64"]]]]]]}],"Hacl_Hash_Blake2s_state_t":["LFlat",{"size":32,"fields":[["block_state",[0,["Layout","Hacl_Hash_Blake2s_block_state_t"]]],["buf",[16,["Pointer",["Int",["A8"]]]]],["total_len",[24,["Int",["A64"]]]]]}],"Hacl_Hash_Blake2s_block_state_t":["LFlat",{"size":16,"fields":[["fst",[0,["Int",["A8"]]]],["snd",[1,["Int",["A8"]]]],["thd",[8,["Layout","K____uint32_t___uint32_t_"]]]]}],"Hacl_Hash_Blake2s_Simd128_state_t":["LFlat",{"size":32,"fields":[["block_state",[0,["Layout","Hacl_Hash_Blake2s_Simd128_block_state_t"]]],["buf",[16,["Pointer",["Int",["A8"]]]]],["total_len",[24,["Int",["A64"]]]]]}],"Hacl_Hash_Blake2s_Simd128_block_state_t":["LFlat",{"size":16,"fields":[["fst",[0,["Int",["A8"]]]],["snd",[1,["Int",["A8"]]]],["thd",[8,["Layout","K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_"]]]]}],"Hacl_Hash_Blake2b_state_t":["LFlat",{"size":32,"fields":[["block_state",[0,["Layout","Hacl_Hash_Blake2b_block_state_t"]]],["buf",[16,["Pointer",["Int",["A8"]]]]],["total_len",[24,["Int",["A64"]]]]]}],"Hacl_Hash_Blake2b_block_state_t":["LFlat",{"size":16,"fields":[["fst",[0,["Int",["A8"]]]],["snd",[1,["Int",["A8"]]]],["thd",[8,["Layout","K____uint64_t___uint64_t_"]]]]}],"Hacl_Hash_Blake2b_Simd256_state_t":["LFlat",{"size":32,"fields":[["block_state",[0,["Layout","Hacl_Hash_Blake2b_Simd256_block_state_t"]]],["buf",[16,["Pointer",["Int",["A8"]]]]],["total_len",[24,["Int",["A64"]]]]]}],"Hacl_Hash_Blake2b_Simd256_block_state_t":["LFlat",{"size":16,"fields":[["fst",[0,["Int",["A8"]]]],["snd",[1,["Int",["A8"]]]],["thd",[8,["Layout","K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_"]]]]}],"Hacl_Hash_Blake2b_index":["LFlat",{"size":2,"fields":[["key_length",[0,["Int",["A8"]]]],["digest_length",[1,["Int",["A8"]]]]]}],"Hacl_Hash_SHA2_uint8_8p":["LFlat",{"size":56,"fields":[["fst",[0,["Pointer",["Int",["A8"]]]]],["snd",[8,["Layout","Hacl_Hash_SHA2_uint8_7p"]]]]}],"Hacl_Hash_SHA2_uint8_7p":["LFlat",{"size":48,"fields":[["fst",[0,["Pointer",["Int",["A8"]]]]],["snd",[8,["Layout","Hacl_Hash_SHA2_uint8_6p"]]]]}],"Hacl_Hash_SHA2_uint8_6p":["LFlat",{"size":40,"fields":[["fst",[0,["Pointer",["Int",["A8"]]]]],["snd",[8,["Layout","Hacl_Hash_SHA2_uint8_5p"]]]]}],"Hacl_Hash_SHA2_uint8_5p":["LFlat",{"size":32,"fields":[["fst",[0,["Pointer",["Int",["A8"]]]]],["snd",[8,["Layout","Hacl_Hash_SHA2_uint8_4p"]]]]}],"Hacl_Hash_SHA2_uint8_4p":["LFlat",{"size":24,"fields":[["fst",[0,["Pointer",["Int",["A8"]]]]],["snd",[8,["Layout","Hacl_Hash_SHA2_uint8_3p"]]]]}],"Hacl_Hash_SHA2_uint8_3p":["LFlat",{"size":16,"fields":[["fst",[0,["Pointer",["Int",["A8"]]]]],["snd",[8,["Layout","Hacl_Hash_SHA2_uint8_2p"]]]]}],"Hacl_Hash_SHA2_uint8_2x8p":["LFlat",{"size":112,"fields":[["fst",[0,["Layout","Hacl_Hash_SHA2_uint8_8p"]]],["snd",[56,["Layout","Hacl_Hash_SHA2_uint8_8p"]]]]}],"Hacl_Hash_SHA2_uint8_2x4p":["LFlat",{"size":48,"fields":[["fst",[0,["Layout","Hacl_Hash_SHA2_uint8_4p"]]],["snd",[24,["Layout","Hacl_Hash_SHA2_uint8_4p"]]]]}],"Hacl_Hash_SHA2_uint8_2p":["LFlat",{"size":8,"fields":[["fst",[0,["Pointer",["Int",["A8"]]]]],["snd",[4,["Pointer",["Int",["A8"]]]]]]}],"Hacl_Impl_HPKE_context_s":["LFlat",{"size":16,"fields":[["ctx_key",[0,["Pointer",["Int",["A8"]]]]],["ctx_nonce",[4,["Pointer",["Int",["A8"]]]]],["ctx_seq",[8,["Pointer",["Int",["A64"]]]]],["ctx_exporter",[12,["Pointer",["Int",["A8"]]]]]]}],"Hacl_Hash_Blake2b_blake2_params":["LFlat",{"size":28,"fields":[["digest_length",[0,["Int",["A8"]]]],["key_length",[1,["Int",["A8"]]]],["fanout",[2,["Int",["A8"]]]],["depth",[3,["Int",["A8"]]]],["leaf_length",[4,["Int",["A32"]]]],["node_offset",[8,["Int",["A64"]]]],["node_depth",[16,["Int",["A8"]]]],["inner_length",[17,["Int",["A8"]]]],["salt",[20,["Pointer",["Int",["A8"]]]]],["personal",[24,["Pointer",["Int",["A8"]]]]]]}],"Hacl_HMAC_DRBG_state":["LFlat",{"size":12,"fields":[["k",[0,["Pointer",["Int",["A8"]]]]],["v",[4,["Pointer",["Int",["A8"]]]]],["reseed_counter",[8,["Pointer",["Int",["A32"]]]]]]}],"Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64":["LFlat",{"size":20,"fields":[["len",[0,["Int",["A32"]]]],["n",[4,["Pointer",["Int",["A64"]]]]],["mu",[8,["Int",["A64"]]]],["r2",[16,["Pointer",["Int",["A64"]]]]]]}],"Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32":["LFlat",{"size":16,"fields":[["len",[0,["Int",["A32"]]]],["n",[4,["Pointer",["Int",["A32"]]]]],["mu",[8,["Int",["A32"]]]],["r2",[12,["Pointer",["Int",["A32"]]]]]]}],"FStar_UInt128_uint128":["LFlat",{"size":16,"fields":[["low",[0,["Int",["A64"]]]],["high",[8,["Int",["A64"]]]]]}],"EverCrypt_Hash_Incremental_state_t":["LFlat",{"size":16,"fields":[["block_state",[0,["Pointer",["Layout","EverCrypt_Hash_state_s"]]]],["buf",[4,["Pointer",["Int",["A8"]]]]],["total_len",[8,["Int",["A64"]]]]]}],"state_s_tags":["LEnum"],"EverCrypt_Hash_state_s":["LFlat",{"size":12,"fields":[["tag",[0,["Int",["A32"]]]],["val",[8,["Union",[["Pointer",["Int",["A32"]]],["Pointer",["Int",["A32"]]],["Pointer",["Int",["A32"]]],["Pointer",["Int",["A32"]]],["Pointer",["Int",["A64"]]],["Pointer",["Int",["A64"]]],["Pointer",["Int",["A64"]]],["Pointer",["Int",["A64"]]],["Pointer",["Int",["A64"]]],["Pointer",["Int",["A64"]]],["Pointer",["Int",["A32"]]],["Pointer",["Unknown"]],["Pointer",["Int",["A64"]]],["Pointer",["Unknown"]]]]]]]}],"EverCrypt_Error_error_code":["LEnum"],"C_String_t_":["LBuiltin",["I32"],["A32"]],"C_String_t":["LBuiltin",["I32"],["A32"]],"C_Compat_String_t_":["LBuiltin",["I32"],["A32"]],"C_Compat_String_t":["LBuiltin",["I32"],["A32"]],"exit_code":["LBuiltin",["I32"],["A32"]],"clock_t":["LBuiltin",["I32"],["A32"]]}
\ No newline at end of file
+{"Spec_Hash_Definitions_hash_alg":["LEnum"],"Prims_string":["LBuiltin",["I32"],["A32"]],"Prims_int":["LBuiltin",["I32"],["A32"]],"K___uint32_t_uint32_t":["LFlat",{"size":8,"fields":[["fst",[0,["Int",["A32"]]]],["snd",[4,["Int",["A32"]]]]]}],"__bool_bool_bool_bool":["LFlat",{"size":4,"fields":[["fst",[0,["Int",["A8"]]]],["snd",[1,["Int",["A8"]]]],["thd",[2,["Int",["A8"]]]],["f3",[3,["Int",["A8"]]]]]}],"__bool_bool":["LFlat",{"size":2,"fields":[["fst",[0,["Int",["A8"]]]],["snd",[1,["Int",["A8"]]]]]}],"K____uint64_t___uint64_t_":["LFlat",{"size":8,"fields":[["fst",[0,["Pointer",["Int",["A64"]]]]],["snd",[4,["Pointer",["Int",["A64"]]]]]]}],"K____uint32_t___uint32_t_":["LFlat",{"size":8,"fields":[["fst",[0,["Pointer",["Int",["A32"]]]]],["snd",[4,["Pointer",["Int",["A32"]]]]]]}],"K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_":["LFlat",{"size":8,"fields":[["fst",[0,["Pointer",["Unknown"]]]],["snd",[4,["Pointer",["Unknown"]]]]]}],"K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_":["LFlat",{"size":8,"fields":[["fst",[0,["Pointer",["Unknown"]]]],["snd",[4,["Pointer",["Unknown"]]]]]}],"Hacl_Streaming_Types_error_code":["LEnum"],"Hacl_MAC_Poly1305_state_t":["LFlat",{"size":20,"fields":[["block_state",[0,["Pointer",["Int",["A64"]]]]],["buf",[4,["Pointer",["Int",["A8"]]]]],["total_len",[8,["Int",["A64"]]]],["p_key",[16,["Pointer",["Int",["A8"]]]]]]}],"Hacl_Streaming_MD_state_64":["LFlat",{"size":16,"fields":[["block_state",[0,["Pointer",["Int",["A64"]]]]],["buf",[4,["Pointer",["Int",["A8"]]]]],["total_len",[8,["Int",["A64"]]]]]}],"Hacl_Streaming_MD_state_32":["LFlat",{"size":16,"fields":[["block_state",[0,["Pointer",["Int",["A32"]]]]],["buf",[4,["Pointer",["Int",["A8"]]]]],["total_len",[8,["Int",["A64"]]]]]}],"Hacl_Hash_SHA3_state_t":["LFlat",{"size":24,"fields":[["block_state",[0,["Layout","Hacl_Hash_SHA3_hash_buf"]]],["buf",[8,["Pointer",["Int",["A8"]]]]],["total_len",[16,["Int",["A64"]]]]]}],"hash_buf2":["LFlat",{"size":16,"fields":[["fst",[0,["Layout","Hacl_Hash_SHA3_hash_buf"]]],["snd",[8,["Layout","Hacl_Hash_SHA3_hash_buf"]]]]}],"Hacl_Hash_SHA3_hash_buf":["LFlat",{"size":8,"fields":[["fst",[0,["Int",["A32"]]]],["snd",[4,["Pointer",["Int",["A64"]]]]]]}],"Hacl_Hash_Blake2s_state_t":["LFlat",{"size":32,"fields":[["block_state",[0,["Layout","Hacl_Hash_Blake2s_block_state_t"]]],["buf",[16,["Pointer",["Int",["A8"]]]]],["total_len",[24,["Int",["A64"]]]]]}],"Hacl_Hash_Blake2s_block_state_t":["LFlat",{"size":16,"fields":[["fst",[0,["Int",["A8"]]]],["snd",[1,["Int",["A8"]]]],["thd",[2,["Int",["A8"]]]],["f3",[8,["Layout","K____uint32_t___uint32_t_"]]]]}],"Hacl_Hash_Blake2s_Simd128_state_t":["LFlat",{"size":32,"fields":[["block_state",[0,["Layout","Hacl_Hash_Blake2s_Simd128_block_state_t"]]],["buf",[16,["Pointer",["Int",["A8"]]]]],["total_len",[24,["Int",["A64"]]]]]}],"Hacl_Hash_Blake2s_Simd128_block_state_t":["LFlat",{"size":16,"fields":[["fst",[0,["Int",["A8"]]]],["snd",[1,["Int",["A8"]]]],["thd",[2,["Int",["A8"]]]],["f3",[8,["Layout","K____Lib_IntVector_Intrinsics_vec128___Lib_IntVector_Intrinsics_vec128_"]]]]}],"Hacl_Hash_Blake2b_state_t":["LFlat",{"size":32,"fields":[["block_state",[0,["Layout","Hacl_Hash_Blake2b_block_state_t"]]],["buf",[16,["Pointer",["Int",["A8"]]]]],["total_len",[24,["Int",["A64"]]]]]}],"Hacl_Hash_Blake2b_block_state_t":["LFlat",{"size":16,"fields":[["fst",[0,["Int",["A8"]]]],["snd",[1,["Int",["A8"]]]],["thd",[2,["Int",["A8"]]]],["f3",[8,["Layout","K____uint64_t___uint64_t_"]]]]}],"Hacl_Hash_Blake2b_Simd256_state_t":["LFlat",{"size":32,"fields":[["block_state",[0,["Layout","Hacl_Hash_Blake2b_Simd256_block_state_t"]]],["buf",[16,["Pointer",["Int",["A8"]]]]],["total_len",[24,["Int",["A64"]]]]]}],"Hacl_Hash_Blake2b_Simd256_block_state_t":["LFlat",{"size":16,"fields":[["fst",[0,["Int",["A8"]]]],["snd",[1,["Int",["A8"]]]],["thd",[2,["Int",["A8"]]]],["f3",[8,["Layout","K____Lib_IntVector_Intrinsics_vec256___Lib_IntVector_Intrinsics_vec256_"]]]]}],"Hacl_Hash_Blake2b_index":["LFlat",{"size":3,"fields":[["key_length",[0,["Int",["A8"]]]],["digest_length",[1,["Int",["A8"]]]],["last_node",[2,["Int",["A8"]]]]]}],"Hacl_Hash_Blake2b_params_and_key":["LFlat",{"size":8,"fields":[["fst",[0,["Pointer",["Layout","Hacl_Hash_Blake2b_blake2_params"]]]],["snd",[4,["Pointer",["Int",["A8"]]]]]]}],"Hacl_Hash_SHA2_uint8_8p":["LFlat",{"size":56,"fields":[["fst",[0,["Pointer",["Int",["A8"]]]]],["snd",[8,["Layout","Hacl_Hash_SHA2_uint8_7p"]]]]}],"Hacl_Hash_SHA2_uint8_7p":["LFlat",{"size":48,"fields":[["fst",[0,["Pointer",["Int",["A8"]]]]],["snd",[8,["Layout","Hacl_Hash_SHA2_uint8_6p"]]]]}],"Hacl_Hash_SHA2_uint8_6p":["LFlat",{"size":40,"fields":[["fst",[0,["Pointer",["Int",["A8"]]]]],["snd",[8,["Layout","Hacl_Hash_SHA2_uint8_5p"]]]]}],"Hacl_Hash_SHA2_uint8_5p":["LFlat",{"size":32,"fields":[["fst",[0,["Pointer",["Int",["A8"]]]]],["snd",[8,["Layout","Hacl_Hash_SHA2_uint8_4p"]]]]}],"Hacl_Hash_SHA2_uint8_4p":["LFlat",{"size":24,"fields":[["fst",[0,["Pointer",["Int",["A8"]]]]],["snd",[8,["Layout","Hacl_Hash_SHA2_uint8_3p"]]]]}],"Hacl_Hash_SHA2_uint8_3p":["LFlat",{"size":16,"fields":[["fst",[0,["Pointer",["Int",["A8"]]]]],["snd",[8,["Layout","Hacl_Hash_SHA2_uint8_2p"]]]]}],"Hacl_Hash_SHA2_uint8_2x8p":["LFlat",{"size":112,"fields":[["fst",[0,["Layout","Hacl_Hash_SHA2_uint8_8p"]]],["snd",[56,["Layout","Hacl_Hash_SHA2_uint8_8p"]]]]}],"Hacl_Hash_SHA2_uint8_2x4p":["LFlat",{"size":48,"fields":[["fst",[0,["Layout","Hacl_Hash_SHA2_uint8_4p"]]],["snd",[24,["Layout","Hacl_Hash_SHA2_uint8_4p"]]]]}],"Hacl_Hash_SHA2_uint8_2p":["LFlat",{"size":8,"fields":[["fst",[0,["Pointer",["Int",["A8"]]]]],["snd",[4,["Pointer",["Int",["A8"]]]]]]}],"Hacl_Impl_HPKE_context_s":["LFlat",{"size":16,"fields":[["ctx_key",[0,["Pointer",["Int",["A8"]]]]],["ctx_nonce",[4,["Pointer",["Int",["A8"]]]]],["ctx_seq",[8,["Pointer",["Int",["A64"]]]]],["ctx_exporter",[12,["Pointer",["Int",["A8"]]]]]]}],"Hacl_Hash_Blake2b_blake2_params":["LFlat",{"size":28,"fields":[["digest_length",[0,["Int",["A8"]]]],["key_length",[1,["Int",["A8"]]]],["fanout",[2,["Int",["A8"]]]],["depth",[3,["Int",["A8"]]]],["leaf_length",[4,["Int",["A32"]]]],["node_offset",[8,["Int",["A64"]]]],["node_depth",[16,["Int",["A8"]]]],["inner_length",[17,["Int",["A8"]]]],["salt",[20,["Pointer",["Int",["A8"]]]]],["personal",[24,["Pointer",["Int",["A8"]]]]]]}],"Hacl_HMAC_DRBG_state":["LFlat",{"size":12,"fields":[["k",[0,["Pointer",["Int",["A8"]]]]],["v",[4,["Pointer",["Int",["A8"]]]]],["reseed_counter",[8,["Pointer",["Int",["A32"]]]]]]}],"Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64":["LFlat",{"size":20,"fields":[["len",[0,["Int",["A32"]]]],["n",[4,["Pointer",["Int",["A64"]]]]],["mu",[8,["Int",["A64"]]]],["r2",[16,["Pointer",["Int",["A64"]]]]]]}],"Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32":["LFlat",{"size":16,"fields":[["len",[0,["Int",["A32"]]]],["n",[4,["Pointer",["Int",["A32"]]]]],["mu",[8,["Int",["A32"]]]],["r2",[12,["Pointer",["Int",["A32"]]]]]]}],"FStar_UInt128_uint128":["LFlat",{"size":16,"fields":[["low",[0,["Int",["A64"]]]],["high",[8,["Int",["A64"]]]]]}],"EverCrypt_Hash_Incremental_state_t":["LFlat",{"size":16,"fields":[["block_state",[0,["Pointer",["Layout","EverCrypt_Hash_state_s"]]]],["buf",[4,["Pointer",["Int",["A8"]]]]],["total_len",[8,["Int",["A64"]]]]]}],"state_s_tags":["LEnum"],"EverCrypt_Hash_state_s":["LFlat",{"size":12,"fields":[["tag",[0,["Int",["A32"]]]],["val",[8,["Union",[["Pointer",["Int",["A32"]]],["Pointer",["Int",["A32"]]],["Pointer",["Int",["A32"]]],["Pointer",["Int",["A32"]]],["Pointer",["Int",["A64"]]],["Pointer",["Int",["A64"]]],["Pointer",["Int",["A64"]]],["Pointer",["Int",["A64"]]],["Pointer",["Int",["A64"]]],["Pointer",["Int",["A64"]]],["Pointer",["Int",["A32"]]],["Pointer",["Unknown"]],["Pointer",["Int",["A64"]]],["Pointer",["Unknown"]]]]]]]}],"EverCrypt_Error_error_code":["LEnum"],"C_String_t_":["LBuiltin",["I32"],["A32"]],"C_String_t":["LBuiltin",["I32"],["A32"]],"C_Compat_String_t_":["LBuiltin",["I32"],["A32"]],"C_Compat_String_t":["LBuiltin",["I32"],["A32"]],"exit_code":["LBuiltin",["I32"],["A32"]],"clock_t":["LBuiltin",["I32"],["A32"]]}
\ No newline at end of file